contempt/phpstan

Release historycaution

The package is only 46 days old and has five releases clustered within roughly three hours. This shows active initial publishing but provides little evidence of long-term maintenance.

Repo bus factorcaution

One contributor made all four recent commits, creating a concentrated maintenance dependency. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

The repository recorded four commits in the last three months, indicating some activity, but the volume is limited for a package with only 46 days of history.

Security policycaution

No repository security policy is present. This is a transparency gap, though the existing composer-audit tooling provides some compensating security practice.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no untrusted checkout or script-injection paths. However, all four action references are unpinned and the audit found a high-confidence unpinned container image, weakening build reproducibility and supply-chain hygiene.