guppylab/plugin-push

Release historycaution

The package is only 1 day old, with five releases clustered about 2 minutes apart. This shows active initial publishing but provides almost no evidence of sustained maintenance or release stability.

Repo commit activitycaution

There were no commits or active maintainers recorded in the last 3 months. Because the package is only 1 day old, this is partly explained by its youth, but ongoing maintenance is still unproven.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a modest repository-hygiene gap, not evidence that the package is unsafe.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response guidance undocumented.

Workflow auditcaution

The single workflow was fully analyzed with no reported audit findings or untrusted checkouts, but all four action references are unpinned. That weakens build reproducibility and supply-chain hygiene.