aseguragonzalez/php-seedwork

Maintainerscaution

Only one account has registry publishing access. This is a modest operational concentration, but the repository shows recent activity from two contributors and the registry list does not measure actual maintenance.

Project backingcaution

The package and repository are owned by the same individual account, which supports provenance but does not provide organizational redundancy.

Repo bus factorcaution

Two contributors are active, but the largest contributor accounts for 62.5% of recent commits and is identified as a release bot, leaving human maintenance capacity relatively concentrated.

Repo popularitycaution

The repository has no stars, forks, or watchers. This is weak supporting evidence for adoption, but popularity alone does not outweigh the observed release and maintenance activity.

Workflow auditcaution

All seven workflows were analyzed and all action references are pinned, but high-confidence findings identify template injection, blanket GitHub App permissions, and inherited secrets. One workflow also has top-level write permissions, so the automation hygiene warrants caution.