rc-dropdown

Build provenancecaution

No build attestation or trusted-publisher record is available, reducing publishing transparency, although this is a publishing-hygiene gap rather than evidence of an unsafe release.

Lifecycle scriptscaution

A prepare install-time script is present, which adds build or execution activity during installation and deserves routine review, though it is not severe on its own.

Release historycaution

The project has 68 releases over more than 11 years, but no registry releases in the last 12 months. Recent repository activity partly compensates for the slower release cadence.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear. Existing security scanning provides partial compensation but does not replace a policy.

Workflow auditcaution

All five workflows were analyzed with no audit findings or untrusted checkouts, but three use top-level write permissions and five of ten action references are unpinned. Without an untrusted trigger, these remain moderate hygiene concerns.