gridphp/ci4-starter

Repo bus factorcaution

All 13 commits in the last three months came from one contributor, giving the project a fully concentrated maintenance base. Because the owner is recorded as a user rather than an organization, there is little provided evidence of handoff capacity.

Repo toolingcaution

Composer is used as a build tool, but no security-scanning tooling is present. That leaves a meaningful supply-chain hygiene gap for a package whose installation scripts fetch and publish assets.

Security policycaution

The repository has no security policy, so there is no documented vulnerability-reporting path or security-maintenance process.

Workflow auditcaution

The sole workflow was fully analyzed, uses job-level permissions, and has no dangerous triggers or audit findings. However, all four action references are unpinned, so build inputs can change without a reviewed version update.