k2gl/sigstore-bundle

Project backingcaution

The repository is owned by a user account rather than an organization, so the single-contributor concentration has no shown organizational handoff to compensate for it.

Release historycaution

The package is only 79 days old and has two releases, both within the last 12 months; the short history limits evidence of long-term maintenance, although the releases were closely spaced.

Repo bus factorcaution

All 10 recent commits came from one contributor, leaving maintenance dependent on a single active person and increasing continuity risk.

Workflow auditcaution

The audit covered all three workflows and found no untrusted checkout or script-injection paths, but it reported a high-confidence bot-conditions issue and two of five unpinned action references. The pull_request_target workflow also has top-level write permissions, so the automation should be tightened.