hyperf/config-aliyun-acm

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. This is partly offset by the release history and the repository push accompanying the current release, but it still weakens evidence of ongoing maintenance.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning is a modest transparency gap rather than evidence of abandonment.

Workflow auditcaution

Both workflows were analyzed successfully and the audit found no findings or untrusted checkouts. However, both workflow action references are unpinned, leaving their versions mutable and creating a supply-chain hygiene concern; the pull_request_target trigger is not risky without an untrusted sink.