compwright/x-hub-signature

Release historycaution

This is the only release, published about 2 years and 5 months ago, with no releases in the last 12 months. The stable release and complete project structure partly offset the limited maintenance history, but the absence of follow-up releases is a real maintenance concern.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months, consistent with a project that may be dormant. Its single-release history provides no compensating evidence of ongoing maintenance.

Repo toolingcaution

The project uses Composer and Make, showing basic build tooling, but no security-scanning tool was detected. For a small stable library this is a modest transparency and maintenance gap rather than a severe risk.

Security policycaution

The repository has no security policy. This reduces transparency for reporting vulnerabilities, though the package's tests and documented release process provide some compensating project hygiene.

Workflow auditcaution

Both workflows were analyzed successfully with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 4 action references are unpinned, leaving a modest workflow supply-chain hygiene gap.