hyperf/pipeline

Dangerous workflowscaution

One of two workflows uses pull_request_target, which requires careful handling of untrusted pull requests. No untrusted checkout or script-injection patterns were detected, limiting the concern.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. This is a meaningful maintenance concern, although the recent registry release and organizational ownership provide some counterevidence.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a hygiene gap rather than evidence that the package is unsafe.

Token permissionscaution

Both workflows lack top-level token permission declarations. No workflow requests top-level write permissions, but explicit least-privilege settings would provide stronger transparency.