@earendil-works/pi-ai
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | publisher-changed | AI (provenance): Transition from human publisher to GitHub Actions CI with SLSA attestation is a legitimate automation upgrade, not a takeover signal. | ai | |
| phantom-deps | phantom-dep:@opentelemetry/api | AI (phantom-deps): @opentelemetry/api is commonly declared as a peer/optional tracing dep without direct top-level imports; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:chalk | AI (phantom-deps): Build/config tool; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:undici | AI (phantom-deps): Implicit Node.js runtime dependency; stable false positive. | ai | |
| phantom-deps | phantom-dep:zod-to-json-schema | AI (phantom-deps): Config/build reference; stable false positive for this package. | ai |
Versions (showing 37 of 37)
| Version | Deps | Published |
|---|---|---|
| 0.82.1 | 11 / 3 | |
| 0.82.0 | 11 / 3 | |
| 0.81.1 | 11 / 3 | |
| 0.81.0 | 11 / 3 | |
| 0.80.10 | 11 / 3 | |
| 0.80.9 | 11 / 3 | |
| 0.80.8 | 11 / 3 | |
| 0.80.7 | 11 / 3 | |
| 0.80.6 | 11 / 3 | |
| 0.80.5 | 11 / 3 | |
| 0.80.3 | 11 / 3 | |
| 0.80.2 | 11 / 3 | |
| 0.80.1 | 11 / 3 | |
| 0.79.10 | 11 / 3 | |
| 0.79.9 | 11 / 3 | |
| 0.79.8 | 11 / 3 | |
| 0.79.7 | 10 / 3 | |
| 0.79.6 | 10 / 3 | |
| 0.79.5 | 10 / 3 | |
| 0.79.4 | 10 / 3 | |
| 0.79.3 | 10 / 3 | |
| 0.79.2 | 10 / 3 | |
| 0.79.1 | 10 / 3 | |
| 0.79.0 | 10 / 3 | |
| 0.78.1 | 10 / 3 | |
| 0.78.0 | 10 / 3 | |
| 0.77.0 | 10 / 3 | |
| 0.76.0 | 10 / 3 | |
| 0.75.5 | 10 / 3 | |
| 0.75.4 | 9 / 3 | |
| 0.75.3 | 9 / 3 | |
| 0.75.2 | 9 / 3 | |
| 0.75.1 | 9 / 3 | |
| 0.75.0 | 9 / 3 | |
| 0.74.2 | 9 / 3 | |
| 0.74.1 | 9 / 3 | |
| 0.74.0 | 11 / 3 |
v0.82.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.82.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.81.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.81.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.80.10
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.80.9
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.80.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.80.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.80.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.80.5
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.80.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.