systeminformation

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, leaving publication origin less verifiable than it could be. This is a transparency gap rather than evidence of unsafe code.

Maintainerscaution

Only one registry account has publish access, creating limited publishing redundancy. This is partly offset by three active repository contributors, but the registry concentration remains a modest concern.

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated maintainer activity and single registry publisher provide little evidence of organizational handoff capacity.

Repo bus factorcaution

One contributor made about 97% of the 87 recent commits, so practical maintenance depends heavily on one person. Two additional contributors remain active, which limits but does not remove the concentration risk.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout, injection, or auditor findings, and two scope permissions at job level. However, all seven action references are unpinned, which weakens build reproducibility and creates a modest workflow supply-chain risk.