google/apiclient

Repo bus factorcaution

All recent commits came from one contributor, creating a narrow recent contributor base. Organization backing partly offsets handoff risk, but no second active contributor is shown.

Repo commit activitycaution

Only 1 commit was recorded in the last 3 months, showing limited recent source activity despite the strong release history. This is a modest maintenance concern rather than evidence of abandonment.

Workflow auditcaution

All three workflows were analyzed without high-confidence audit findings or untrusted checkouts, but all 15 action references are unpinned and two workflows grant top-level write permissions. The unpinned references are a supply-chain hygiene concern; broad permissions are a mild concern without an untrusted trigger or sink.