underscore

Build provenancecaution

No build attestation or trusted-publisher provenance is present, which limits publication transparency, but this is a supporting gap rather than evidence of abandonment.

Project backingcaution

The linked repository belongs to an individual rather than an organization, so the concentrated recent contributor activity is not offset by visible organizational handoff capacity.

Repo bus factorcaution

One contributor made all four commits in the last three months, creating a concentrated maintenance path and increasing continuity risk for future changes.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injections, or audit findings. However, all four action references are unpinned, which weakens build reproducibility, while job-level permissions are appropriately scoped.