yoctocolors

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable than it could be.

Repo bus factorcaution

All two recent commits came from one contributor, so maintenance depends heavily on a single person.

Workflow auditcaution

The only workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injections, or audit findings. Both action references are unpinned, which is a supply-chain hygiene weakness, but no untrusted execution path was found.