bircher/php-merge

Lifecycle scriptscaution

A post-install-cmd script runs during installation. Install-time execution adds supply-chain and reproducibility exposure, although this signal alone does not show that the script is harmful.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Releases remain recent, but the lack of recent source activity is a meaningful maintenance concern.

Security policycaution

The repository has no security policy. This is a transparency gap, though the package's small scope and other maintenance evidence partly limit its significance.

Workflow auditcaution

The only workflow was fully analyzed with no untrusted checkouts, injection findings, or audit findings, and it does not use broad top-level write permissions. However, all four action references are unpinned, which weakens build reproducibility and action supply-chain hygiene.