acdh-oeaw/arche-assets

Repo bus factorcaution

All 4 recent commits came from one contributor, creating a narrow operational base; organization ownership provides some capacity to hand maintenance off, but no second active contributor is shown.

Repo popularitycaution

The repository has no stars or forks and only 5 watchers, so external adoption evidence is limited; popularity is supporting evidence rather than a primary health verdict.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, reducing clarity about vulnerability reporting and response procedures.

Workflow auditcaution

All four workflows were analyzed without untrusted checkouts or script injection, but all 10 action references are unpinned and the audit reports trusted publishing; these create build-reproducibility and credential-handling concerns without evidence of an exploitable trigger.