dama/doctrine-test-bundle

Project backingcaution

The repository is owned by an individual rather than an organization, so the project has limited visible institutional backing; its long release history and recent release partly compensate.

Repo commit activitycaution

The repository recorded no commits and no active maintainers during the last 3 months, a meaningful maintenance warning even though a release was published recently.

Repo toolingcaution

Composer and Make provide build tooling, but no security-scanning tool is configured; this is a modest transparency and maintenance gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear; this is a hygiene concern for a dependency but not a severe health risk alone.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, script injection, or audit findings, but all 6 of its action references are unpinned. The missing top-level permissions block is acceptable on its own.