andreibesleaga/a2a-php

Project backingcaution

The package and repository are owned by the same individual account, so the source link is coherent, but there is no organization backing shown to broaden maintenance capacity.

Repo bus factorcaution

One contributor made 100% of the single recent commit, leaving maintenance concentrated in one person; the user-owned project backing provides less handoff capacity than an organization-owned project.

Repo commit activitycaution

Only 1 commit was recorded in the last 3 months, which is thin activity despite the recent merged pull requests and release cadence.

Version stabilitycaution

The assessed release is v0.9.6-beta, and all recent releases are prereleases, so consumers should expect API or behavior changes before a stable major release.

Workflow auditcaution

All three workflows were analyzed with no reported audit findings or untrusted-code sinks, and two use read-only permissions. However, all 16 action references are unpinned and one workflow has top-level write permissions, creating a meaningful reproducibility and token-scope hygiene concern.