hexide-digital/gitlab-deploy
The source includes tests, a changelog, release notes, and a matching README, with no deprecation notice or archival status. Workflow hygiene is weak: all nine actions are unpinned, and a high-confidence bot-condition issue remains.
58%
Total Score
75
92
50
Health Score Breakdown
The package runs a post-autoload-dump install-time script, which adds execution during installation and warrants more scrutiny than a package without lifecycle hooks.
The package has 31 releases since April 2022, but none in the last two years, indicating a meaningful maintenance slowdown for a deployment tool.
The repository recorded no commits and had no active maintainers in the last three months, which raises near-term abandonment risk despite the repository remaining available.
All 9 analyzed action references are unpinned, and the audit found a high-confidence bot-condition issue; the pull-request-target workflow has no untrusted checkout or script-injection findings, limiting the severity.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Oleksandr-Moik |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 symfony/yaml Version ^6.1 || ^7.0 | — | — |
symfony/console Version ^6.0 || ^7.0 | — | — |
symfony/process Version ^6.0 || ^7.0 | — | — |
deployer/deployer Version ^7.3 | — | — |
guzzlehttp/guzzle Version ^7.4 | — | — |
Weekly Downloads
Info
- Last Published
- 2 years ago
- Created
- 4 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.