crmleaf/payslip-generator

Release historycaution

The package is only 42 days old with two releases, so there is limited evidence of sustained maintenance. The repository has 14 commits in the last three months, which provides some compensating activity but not a long track record.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no untrusted checkouts, script injection, or audit findings. However, all 12 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.