infinum/eightshift-coding-standards

Dependency profilecaution

Four runtime dependencies are declared, including the PHP compatibility and WordPress coding-standard packages this tool needs; the profile is purposeful but creates upstream maintenance exposure.

Repo bus factorcaution

All 3 recent commits came from one contributor, giving the project a concentrated recent maintenance base; the organization backing provides some ability to hand work off.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected; for a coding-standards package this is a modest transparency gap rather than a severe concern.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unspecified.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 21 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.