goal-api/sdk

Release historycaution

This is a young package with one release in 44 days, so there is little release history from which to judge long-term maintenance stability.

Repo bus factorcaution

All 31 recent commits came from one contributor, creating concentration risk; organization backing provides some ability to hand off maintenance but does not remove the current dependency on one active contributor.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving an avoidable transparency and monitoring gap.

Workflow auditcaution

All three workflows were analyzed successfully and have no detected injection or high-severity findings, but all six action references are unpinned, weakening build reproducibility and update control.