ion-bazan/guzzle-bundle-aliyun-signer-plugin

Release historycaution

This is the only release, published over six years ago, with no releases in the last 12 months. That strongly limits evidence of continued maintenance.

Repo commit activitycaution

The repository recorded no commits in the last three months and has no active maintainers in that period; its last push was over five years ago. This is a substantial abandonment concern.

Security policycaution

The linked repository has no security policy. For a small package with no other reported security tooling, this reduces transparency and makes vulnerability reporting less clear.

Workflow auditcaution

All four analyzed action references are unpinned, which weakens build reproducibility and update control. However, the workflow has no untrusted checkout, script-injection, dangerous trigger, or high-confidence audit finding, so this remains a hygiene concern.