cu-boulder/boulder_profile

Package scaffoldingcaution

A README and changelog are present, and the repository uses GitHub Releases, which supports package transparency. However, neither the artifact nor repository contains tests, leaving a maintenance-quality gap for a Drupal installation profile.

Repo toolingcaution

Composer build tooling is present, supporting reproducible project conventions, but no security scanning tools were detected, leaving a supply-chain hygiene gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response procedures.

Token permissionscaution

All four workflows lack top-level token permissions declarations. Although none declares top-level write access, the absence of explicit least-privilege settings is a workflow security hygiene concern.