k3n/tonictypes

Recent releases, tests, documentation, and release notes show a functioning project with clear consumer support. The small contributor base, absent security scanning, and unpinned workflow actions warrant extra operational caution.

Latest 2.1.0

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made 20 of 21 recent commits, so maintenance is highly concentrated despite a second active contributor and organization backing.

Repo tooling

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest transparency and assurance gap.

Security policy

The repository has no security policy, so vulnerability-reporting and response expectations are not documented.

Workflow audit

All four workflows were analyzed without dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all four action references are unpinned, which weakens build reproducibility and supply-chain hygiene.