pretty-format

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, which leaves publication origin less verifiable, but the repository and release history provide substantial compensating transparency.

Repo bus factorcaution

One contributor made about 96% of the recent commits, creating a meaningful concentration risk despite two other active contributors and organization backing.

Repo package mentioncaution

The repository name does not match pretty-format and its README does not mention the package, so the package-to-repository relationship is less transparent; the organization-backed Jest monorepo context partly offsets this concern.

Workflow auditcaution

All 11 workflows were analyzed, all 48 action references are pinned, and no untrusted checkout or script-injection paths were found. The high-confidence use-trusted-publishing finding and three workflows with top-level write permissions are workflow hygiene concerns, though no high- or medium-severity issue was reported.