codeigniter4/tasks

Lifecycle scriptscaution

A post-update-cmd lifecycle script runs during Composer updates, which adds execution surface beyond ordinary installation. No provided signal shows that this script is harmful or unusually broad, so this is a modest hygiene concern.

Release historycaution

The package is about 177 days old with two releases, both within the last 12 months. Its short history provides limited evidence of long-term maintenance, although the releases were made close together during initial development.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. That is a concrete maintenance gap, though the project is still young and was pushed more recently than the measured commit window.

Workflow auditcaution

All 11 action references are unpinned, weakening build reproducibility, and the docs workflow has four high-confidence template-injection findings; because no untrusted trigger or checkout was found, these remain workflow hygiene concerns rather than standalone severe risk.