resolve-options

Build provenancecaution

No build attestation or trusted-publisher provenance is present, limiting verification of how the published artifact was produced; this is a transparency gap rather than a health verdict on its own.

Release historycaution

The package has only three releases and none in the last 12 months; its latest release was June 24, 2022, so maintenance freshness is uncertain despite its long history.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, reinforcing concern that maintenance has slowed substantially.

Repo toolingcaution

The repository uses a build tool, but no security scanning tools were detected; the missing scanning is a modest process gap, partly offset by the repository's security policy.

Workflow auditcaution

Both workflows were analyzed with no injection or high-severity findings, but all seven action references are unpinned, leaving workflow dependencies exposed to moving upstream references.