acdh-oeaw/arche-schema

The package is licensed, clearly documented, and backed by a matching organization repository with release notes. Unpinned workflow actions and no security policy add modest build and transparency concerns.

Latest 6.0.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has a substantial history of 44 releases since 2017, but none in the last 12 months; the latest release was in June 2025. This suggests slowing maintenance, though the long release history provides maturity.

Repo commit activity

There were no commits and no active maintainers in the last three months. Although the repository was pushed more recently, the measured activity indicates limited current maintenance.

Repo tooling

Composer build tooling is present, but no security scanning tool was detected. This is a modest process gap rather than evidence of abandonment.

Security policy

The repository has no security policy. That reduces transparency for reporting and handling vulnerabilities, but it does not by itself show that the package is unsafe to depend on.

Workflow audit

Both workflows were analyzed successfully with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all four action references are unpinned, leaving a build reproducibility and action-integrity gap.