ruflo

Workflow auditdanger

The audit found 148 unpinned action references out of 150, use of long-lived trusted-publishing credentials, and high-confidence template-injection findings in workflows including workflow_run jobs. It also analyzed only 30 of 33 workflows, so the workflow supply-chain posture needs remediation.

Licensecaution

The manifest declares MIT and the artifact and repository contain license files, but the detected artifact license is Apache-2.0, creating a material license mismatch that consumers should resolve.

Project backingcaution

The repository is owned by a user account rather than an organization, so the concentrated contributor activity is not buffered by explicit organization backing.

Repo bus factorcaution

Seventeen contributors were active, but the top contributor made 71.6% of recent commits; the second contributor supplied 17.1%, so maintenance is active but meaningfully concentrated.