codeq/workspace-review

Usable with caveats: it is actively developed and has tests, clear licensing, and organizational backing, but it is only 48 days old and all recent commits come from one contributor. The lack of security scanning and a security policy adds transparency risk.

Latest v0.3.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

Six releases in the last 48 days, with a median interval of about 18 hours, show active delivery but provide limited evidence of long-term maturity because the package is very new.

Repo bus factor

One contributor made 100% of the 19 recent commits. Organizational backing partly offsets the handoff risk, but the observed maintenance capacity remains concentrated.

Repo commit activity

The repository received 19 commits in the last 3 months, but all were made by one active maintainer. The activity is strong, while the narrow contributor base limits continuity.

Repo popularity

The repository has only 2 stars and no forks or watchers, indicating limited external adoption. This is supporting evidence of low maturity, not a verdict by itself.

Repo tooling

Composer is used as a build tool, but no security scanning tools are configured. The missing scanning reduces assurance for a dependency intended for production projects.