contenir/contenir-workflow

Registry deprecationdanger

Packagist marks the package abandoned at package scope and names contenir/contenir-workflow-mezzio as its replacement. That directly makes this release unsuitable as a new dependency despite the active replacement repository.

Repo commit activitycaution

The repository shows zero commits and zero active maintainers in the last 3 months, although it was pushed recently and had four merged pull requests in the last month. The recent repository transition makes this mixed rather than conclusive abandonment evidence.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap, not a standalone reason to reject the package.

Security policycaution

The linked repository has no security policy. That weakens vulnerability-reporting transparency, though it is secondary to the explicit registry replacement.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout or script-injection findings, but its only action use is unpinned and the audit found a high-confidence medium-severity secrets-inherit issue. These are avoidable workflow hygiene and credential-scope concerns.