grazulex/laravel-turbomaker

Lifecycle scriptscaution

A post-autoload-dump install script is present. This is a normal Composer integration point, but it adds install-time behavior that should be understood before adoption.

Maintainerscaution

Only one account has registry publish access, which creates a limited publishing-capacity concern. The user-owned repository and recent release activity provide some compensation, but not a second maintainer.

Repo commit activitycaution

No commits and no active maintainers were recorded in the last three months, which is a meaningful maintenance concern. The recent 2.4.0 release and same-day repository push partly offset this, but the activity pattern is still thin.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a transparency and defense-in-depth gap, not evidence that the package is unsafe.

Token permissionscaution

All workflows declare permissions; two use read-only permissions and two use top-level write permissions for release and label synchronization tasks. The explicit declarations are good practice, though write access increases workflow impact if compromised.