orval

Build provenancecaution

No registry build attestation or trusted-publisher identity is present, leaving publication provenance less independently verifiable. The active repository and release history partially compensate, but do not remove this transparency gap.

Dependency profilecaution

The package declares 25 runtime dependencies, including multiple related Orval packages. This is a substantial dependency surface, though it is consistent with the package's broad code-generation functionality.

Workflow auditcaution

All seven workflows were analyzed with no untrusted checkout or script-injection findings, but all 23 action references are unpinned and several workflows grant top-level write access. High-confidence template-injection findings and trusted-publishing findings add workflow hygiene concerns, while the low-confidence cache finding is not decisive.