astrotomic/phpunit-assertions

Lifecycle scriptscaution

The package uses a post-autoload-dump install-time script. This is an additional installation behavior to understand, but the signal provides no evidence that it is harmful or unusually broad.

Repo bus factorcaution

All one commit in the last three months came from one contributor, giving the recent activity a very concentrated bus factor. Organization ownership provides some handoff capacity, but no second recent contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest visibility gap rather than evidence of unsafe maintenance.

Version stabilitycaution

Version 0.15.0 is not a prerelease and recent releases are stable, though the package remains below a stable major version and may allow more compatibility changes.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous audit findings or untrusted-trigger sinks, and neither grants top-level write permissions. However, all 4 referenced actions are unpinned, which weakens build reproducibility and action supply-chain control.