deegitalbe/laravel-trustup-io-notifier

Workflow auditdanger

All 14 analyzed action references are unpinned, and the audit found high-confidence issues involving spoofable bot conditions, broad GitHub App permissions, and an unpinned container image. Release automation also uses trusted publishing with a long-lived token, adding supply-chain hygiene risk.

Release historycaution

The package has existed for more than four years with 24 releases, but only one release occurred in the last 12 months, indicating a slower release pace.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. A recent release and push provide some continuity, but this still raises maintenance risk.

Repo issue activitycaution

There are no open issues and three open pull requests, but no issues or pull requests were merged in the last month. This offers limited evidence of active project engagement.

Repo popularitycaution

The repository has no stars or forks and one watcher. Popularity is only supporting evidence, so this modest adoption does not outweigh the maintenance and workflow findings.