helsingborg-stad/municipio

Lifecycle scriptscaution

Composer post-update-cmd and pre-autoload-dump scripts run during dependency operations, adding execution complexity for consumers. No other provided signal specifically compensates for this, so it is a modest supply-chain hygiene concern.

Security policycaution

The repository has no published security policy. That reduces transparency for reporting and handling vulnerabilities, although the reported security scanning provides partial operational compensation.

Workflow auditcaution

All five workflows were analyzed with no untrusted checkouts, script injection, or write-all top-level permissions; one workflow scopes permissions at job level. However, all 16 action references are unpinned and the release workflow has a high-confidence adhoc-packages finding, creating build reproducibility and workflow-hygiene concerns.