bnussbau/trmnl-pipeline-php

Project backingcaution

The repository is owned by the same individual account that publishes the package, so the single-person maintenance concentration is not offset by organization backing.

Repo bus factorcaution

One contributor made all recent commits, leaving maintenance dependent on a single active person and increasing continuity risk.

Repo commit activitycaution

Only two commits were recorded in the last three months, so current maintenance activity is modest despite the recent release.

Workflow auditcaution

The audit found a high-confidence, high-severity bot-condition issue in the Dependabot auto-merge workflow. All nine action references are unpinned, and a test workflow installs a package outside its lockfile, adding workflow supply-chain hygiene concerns.