sql-formatter

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded for this release. This weakens publication transparency, although the active repository and release history provide compensating maintenance evidence.

Repo toolingcaution

The project uses TypeScript, Babel, webpack, and npm scripts, showing an established build process. No security scanning tools were detected, which is a modest transparency and hygiene gap.

Security policycaution

The repository has no security policy. This does not show abandonment, but it leaves vulnerability-reporting expectations and response procedures undocumented.

Workflow auditcaution

Both workflows were analyzed successfully and no dangerous triggers, untrusted checkouts, script injections, or audit findings were reported. However, all seven action references are unpinned, so future action changes could affect builds; the absence of a top-level permissions block is not concerning by itself here.