bagisto/bagisto

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected; the gap is partly offset by the repository's separate security policy.

Version stabilitycaution

This is a prerelease beta, so compatibility may still change; however, only 25% of recent releases are prereleases, limiting the concern to version stability rather than project health.

Workflow auditcaution

All five workflows were analyzed with no untrusted checkouts or script-injection counts, and four use read-only permissions. However, all 23 action references are unpinned, while two high-confidence template-injection findings in docker-publish.yml warrant CI review; the low-confidence cache findings are hygiene only.