digedag/rn-base

Licensecaution

The manifest declares GPL-2.0-or-later, but the only detected license file is MIT and does not appear to cover the whole package. This mismatch creates licensing uncertainty.

Repo toolingcaution

The project uses Composer for builds, but no security-scanning tool was detected. That is a modest transparency gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and handling expectations undocumented.

Workflow auditcaution

Both workflows were analyzed successfully with no untrusted checkouts, script injection, or audit findings. However, all 19 referenced actions are unpinned, reducing build reproducibility and increasing exposure to upstream action changes.