parse-github-url

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the relationship between source and published artifact less verifiable.

Project backingcaution

The repository is owned by an individual rather than an organization, so the project has less visible institutional backing and depends more on its maintainer base.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. The recent release and push provide some compensation, but ongoing maintenance activity is limited.

Repo toolingcaution

The repository reports no build tool and no security scanning tool, leaving automated quality and security checks relatively thin for a published package.

Workflow auditcaution

All six workflows were analyzed successfully and no audit findings or untrusted checkouts were reported. However, all six action references are unpinned, and one workflow grants top-level write permissions, creating workflow-supply-chain and token-scope hygiene concerns.