@backstage/repo-tools — Greenflagged

CLI for Backstage repo tooling

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.

Maintainers

patrikofrebenmarcuseide

Keywords

backstage

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
publish-pattern	new-deps-added	AI (publish-pattern): @prettier/sync is an official Prettier package; addition is benign and consistent with this CLI's formatting use case.	ai	2026/05/27
dependencies	unvetted-dep:yaml-diff-patch	AI (dependencies): yaml-diff-patch is a small YAML patching utility; appropriate for a repo tooling package.	ai	2026/04/27
dependencies	unvetted-dep:knip	AI (dependencies): knip is a well-known dead-code/unused-exports finder; legitimate dev tooling dependency for a repo-tools CLI.	ai	2026/04/27
dependencies	unvetted-dep:@microsoft/api-documenter	AI (dependencies): Part of Microsoft's API toolchain, consistent with the already-approved @microsoft/api-extractor dependency in this package.	ai	2026/04/27
dependencies	unvetted-dep:@useoptic/openapi-utilities	AI (dependencies): Optic's OpenAPI utilities; legitimate OpenAPI tooling used by this repo-tools CLI.	ai	2026/04/27
dependencies	unvetted-dep:@apisyouwonthate/style-guide	AI (dependencies): APIs You Won't Hate style guide for Spectral; legitimate OpenAPI linting ruleset.	ai	2026/04/27
dependencies	unvetted-dep:@stoplight/spectral-rulesets	AI (dependencies): Stoplight Spectral rulesets; standard OpenAPI linting component used alongside other @stoplight packages.	ai	2026/04/27
dependencies	unvetted-dep:@stoplight/spectral-formatters	AI (dependencies): Stoplight Spectral formatters; standard OpenAPI linting component, consistent with other @stoplight deps.	ai	2026/04/27
dependencies	unvetted-dep:@openapitools/openapi-generator-cli	AI (dependencies): OpenAPI Generator CLI; well-known code generation tool appropriate for a repo-tools CLI.	ai	2026/04/27
phantom-deps	phantom-dep:@electric-sql/pglite	AI (phantom-deps): pglite is used as a runtime dependency for database tooling features; referenced in config files is expected for this package.	ai	2026/04/26
phantom-deps	phantom-dep:@backstage/catalog-model	AI (phantom-deps): Same-org Backstage dependency; phantom detection is a false positive for this monorepo CLI tool.	ai	2026/04/26
phantom-deps	phantom-dep:@stoplight/spectral-runtime	AI (phantom-deps): Spectral runtime is a transitive/config-level dependency for OpenAPI linting; phantom detection is a false positive here.	ai	2026/04/26
phantom-deps	phantom-dep:@openapitools/openapi-generator-cli	AI (phantom-deps): openapi-generator-cli is invoked as a CLI tool via config, not directly imported; phantom detection is a false positive for this tooling package.	ai	2026/04/26
provenance	no-provenance	AI (provenance): Backstage packages historically do not publish with Sigstore provenance; this is consistent across the ecosystem and not a risk signal.	ai	2026/04/26
phantom-deps	phantom-dep:is-glob	AI (phantom-deps): is-glob is a utility dependency used in config/helper contexts; phantom detection is a false positive for this CLI tooling package.	ai	2026/04/26
phantom-deps	phantom-dep:knip	AI (phantom-deps): knip is declared as a dependency and used as a CLI tool invoked via config; not directly imported in source is expected for this tooling package.	ai	2026/04/26