atk4/validate

Release historycaution

The latest registry release was over two years ago, with no releases in the last 12 months. This is a meaningful maintenance concern, although the repository was pushed more recently.

Repo commit activitycaution

There were no commits and no active maintainers in the three months measured, while the last push was over a year earlier. This points to slowed maintenance and raises abandonment risk.

Repo toolingcaution

The repository uses Composer, but no security-scanning tool was detected. The missing scanner is a modest transparency gap rather than evidence of unsafe code.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a minor transparency concern for a dependency.

Workflow auditcaution

All eight analyzed action references are unpinned, and the audit found four high-confidence unpinned container images, including a floating latest tag. The workflows have no untrusted triggers or script-injection findings, so this is a reproducibility and supply-chain hygiene concern rather than a severe standalone risk.