figuren-theater/ft-onboarding

Dependency profilecaution

Nine runtime dependencies make this a relatively broad integration package, which increases the maintenance surface, though the dependency list is explicit.

Release historycaution

The package has 12 releases since February 2024, but only 1 release in the last 12 months and the latest release is about 10 months old, indicating a slow cadence.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last 3 months, which is meaningful evidence of currently inactive maintenance.

Security policycaution

No security policy is present. This is a transparency gap, although the package's Dependabot configuration provides some compensating security-maintenance coverage.

Workflow auditcaution

All 4 analyzed workflows use unpinned actions, and all 4 have high-confidence medium-severity secrets-inherit findings. There are no untrusted checkouts or script injections, but the combination leaves workflow supply-chain and credential-scope hygiene concerns.