hyperf/watcher

Dangerous workflowscaution

One of two workflows uses pull_request_target, which can increase CI risk, but no untrusted checkout or script-injection patterns were detected. The mitigations keep this at caution rather than danger.

Package scaffoldingcaution

The package artifact has no README, which makes integration harder for a library, but the repository contains tests and this exact version has GitHub release notes. The missing package tests and changelog are normal for published artifacts.

Repo bus factorcaution

All 2 recent commits came from one contributor, giving the project a concentrated recent maintenance base. Organization ownership provides some handoff capacity, but no second recent contributor is shown.

Repo commit activitycaution

Only 2 commits were recorded in the last 3 months, showing limited recent development activity despite the recent release. This is a modest maintenance concern rather than evidence of abandonment.

Repo toolingcaution

Composer is used for builds, which fits the package ecosystem, but no security scanning tools were detected. The missing scanning is a transparency gap, though it is not by itself evidence of unsafe maintenance.