astrophp/trail

Release historycaution

This is the package's first release, published today, so there is no release cadence or track record yet. That is a meaningful maturity gap, but not evidence of abandonment for a newly launched project.

Repo commit activitycaution

No commits or active maintainers were recorded in the previous three months, so there is no established maintenance history. The same-day repository push and 93 merged pull requests show recent project activity but do not establish a durable cadence.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. This is a modest transparency and hygiene gap rather than a standalone adoption blocker.

Version stabilitycaution

The release is v0.1.0 rather than a stable major version, indicating an early API and maturity stage. It is not marked as a prerelease, which partly offsets the concern.

Workflow auditcaution

All three workflows use read-only permissions and the audit found no untrusted checkouts or script injection. However, all 14 action references are unpinned; the low-confidence cache-poisoning finding is hygiene at most, but the lack of pinning remains a caution.