jetcod/eloquent-keygen

Clear documentation, tests, and release notes make the package straightforward to evaluate and adopt. One active contributor, no security policy, and unpinned workflow actions leave maintenance and build-integrity gaps worth checking.

Latest 1.2.0

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has three releases over about two and a half years, with only one release in the last 12 months and roughly 15 months between typical releases. The recent 1.2.0 release shows current activity, but the overall cadence is sparse.

Repo bus factor

All 14 recent commits came from one contributor, creating a concentrated maintenance dependency. Organization backing partly compensates by providing a potential handoff path.

Repo tooling

Composer build tooling is present, but no security-scanning tool is reported, leaving a modest verification gap.

Security policy

The repository has no security policy, reducing transparency about vulnerability reporting and maintainer response expectations.

Workflow audit

The sole workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings, and it scopes permissions at job level. However, all six action references are unpinned, which weakens build reproducibility and action supply-chain integrity.