orval

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, leaving publication provenance less transparent despite the package's otherwise strong maintenance evidence.

Workflow auditcaution

All 23 analyzed action references are unpinned, four workflows grant top-level write permissions, and high-confidence template-injection findings appear in release preparation; the audit also flags trusted-publishing usage. The template findings are not shown in the same workflow as an untrusted checkout or script-injection sink, so this is a hygiene concern rather than a severe workflow risk.