Package Health/bitcodesa/deployment-script

bitcodesa/deployment-script

Usable with caveats: the package is licensed, documented, tested in its repository, and not deprecated or archived. However, it has had no registry release in over two years and no commits in the last three months, so maintenance appears stalled.

Latest 0.0.2

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo commit activity

There were no commits and no active maintainers in the last three months, reinforcing the release-history evidence that maintenance is currently stalled.

Dangerous workflows

One workflow uses pull_request_target for Dependabot auto-merge, but no untrusted checkout or script-injection patterns were detected. The workflow pattern warrants review but is not severe on the collected evidence.

Lifecycle scripts

A post-autoload-dump install script runs during Composer installation. This is a supply-chain-sensitive behavior that deserves review, although the signal does not establish that it is harmful.

Release history

Only two releases were published, with the latest over two years ago and no releases in the last 12 months. This is a meaningful sign of low ongoing maintenance for a deployment utility.

Repo popularity

The repository has only 3 stars and 1 fork. Low popularity is supporting evidence rather than a defect, but it provides little independent evidence of broad review or adoption.