yoga-layout

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less transparent than it could be, but this is not by itself evidence of poor maintenance.

Release historycaution

The package has 25 releases over about 9 years but no registry release in nearly two years. This is a real publishing-cadence concern, although the active repository provides compensating maintenance evidence.

Repo toolingcaution

The project uses CMake and TypeScript build tooling. No security-scanning tools were detected, a modest process gap, but repository tests and active maintenance provide useful compensating evidence.

Workflow auditcaution

All ten workflows were analyzed with no untrusted checkout or script-injection findings, and seven use read-only permissions. However, all 24 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.