friendsofhyperf/config-consul

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can require careful handling of untrusted pull requests; no untrusted checkout or script injection was detected to offset the concern.

Repo commit activitycaution

No commits and no active maintainers were recorded in the last 3 months, which is a maintenance concern, although the recent release history and June repository push provide some compensating evidence.

Repo popularitycaution

The repository has no stars and only one fork or watcher, limiting popularity as supporting evidence; popularity is not decisive for a focused package with strong release activity.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and assurance gap.

Token permissionscaution

Both workflows lack top-level token-permission declarations. No workflow requests top-level write access, but explicit least-privilege permissions would provide better supply-chain hygiene.