relay-runtime

Repo package mentioncaution

The repository name does not match relay-runtime and its README does not mention the package, which creates a modest ownership-transparency concern. The repository is the Relay monorepo and is organization-backed, so the mismatch is partly explained.

Repo toolingcaution

The project uses established build tooling, but no security-scanning tools were detected. This is a limited hygiene gap, offset by active maintenance, provenance, and a published security policy.

Workflow auditcaution

All 44 action references are unpinned, and high-confidence findings include archived actions and an ad-hoc package install; trusted publishing was also flagged. Workflows were fully analyzed with no untrusted checkout or script-injection sinks, so this is a hygiene concern rather than a severe dependency risk.