responselike

Build provenancecaution

No build attestation or trusted-publisher provenance is present, limiting publication transparency. This is a moderate hygiene gap rather than evidence that the release is unsafe.

Repo commit activitycaution

There were no commits or active maintainers in the last 3 months, which is a maintenance warning, although the recent release history and repository push provide some compensation.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, sinks, or audit findings. However, both action references are unpinned, leaving the workflow exposed to upstream action changes.