assessing-third-party-components

Use for a standalone ungoverned read-only clearance of an exact third-party software component or immutable artifact, including provenance, license, dependencies, and conformance checks before adoption or maintenance. Includes packages, vendored artifacts, Actions, images, toolchains, CLIs, and agent plugins; a governed advisory enters maintenance first, and mutation and generic vendor, release, deployment, Git, PR, or review work are excluded.