calliostro/discogs-bundle

Repo commit activitycaution

No commits and no active maintainers were recorded in the last 3 months, which is a maintenance concern, although the current release and same-day repository push provide compensating evidence.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected; this is a modest transparency and maintenance gap rather than evidence of abandonment.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations unclear.

Workflow auditcaution

All 10 action references are unpinned, and the audit reports high-confidence template-injection findings; however, the workflow has no pull_request_target or workflow_run trigger and no untrusted checkout or script-injection sink, so these remain hygiene concerns rather than a severe release risk.