inisiatif/common

Repo bus factorcaution

One contributor made all commits in the last three months, giving the repository a 100% top-contributor share. Organization ownership provides some handoff capacity, but no second recent contributor is shown to support that capacity.

Repo commit activitycaution

Only one commit was recorded in the last three months, from one active maintainer. Recent release activity is reassuring, but this low current activity leaves limited evidence of sustained maintenance.

Security policycaution

No repository security policy was found. That is a transparency and vulnerability-reporting gap, although the repository does use Dependabot and Psalm, which partly compensates for the missing policy.

Workflow auditcaution

All four workflows were analyzed, but all 10 action references are unpinned, and the auditor reported a high-confidence bot-conditions finding in the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so the workflow issues are caution-level hygiene concerns rather than a severe standalone risk.