reserved-identifiers

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, leaving the relationship between the source and published artifact less verifiable than it could be.

Project backingcaution

The repository is owned by an individual rather than an organization, so the project has limited visible institutional backing; the current source and release activity provide some compensation.

Repo commit activitycaution

No commits or active maintainers were recorded in the last three months. The recent repository push and current release history partly offset this, but ongoing maintenance capacity is not strongly demonstrated.

Repo toolingcaution

The repository reports no build tool or security scanning tool. For this small package that is a modest hygiene gap, not evidence that the package is unfit to use.

Workflow auditcaution

The single workflow was fully audited with no high- or medium-confidence findings, no untrusted checkouts, and no script injection. However, both of its action references are unpinned, which weakens build reproducibility.