cu-boulder/ucb_site_configuration

Release historycaution

The package has only four releases and none in the last 12 months; its latest registry release was in December 2023, indicating a real freshness concern for a Drupal module.

Repo commit activitycaution

No commits or active maintainers were recorded in the last three months, which weakens evidence of ongoing maintenance despite the repository not being archived.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected; this is a modest process gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented and reducing transparency for a package used in site administration.

Workflow auditcaution

All five workflows use unpinned actions, and a high-confidence medium-severity finding shows a reusable workflow inheriting secrets. No untrusted checkout or script injection was found, so this is a hygiene and credential-scope concern rather than a severe workflow risk.