cu-boulder/boulder_base

Package scaffoldingcaution

A substantive README and changelog are present, and the repository uses GitHub Releases, but neither the artifact nor repository contains tests. For a Drupal theme this is a maintenance and regression-testing gap, though linting and active development provide some compensation.

Repo toolingcaution

Composer is used as a build tool, but no security scanning tools are configured. The missing security automation is a hygiene gap, although the repository has other CI workflows and no dangerous workflow patterns were detected.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Token permissionscaution

All five workflows lack top-level token permissions declarations. Although none declares top-level write access, explicit least-privilege permissions would provide stronger CI security hygiene.