league/oauth2-google

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last three months. Although a release was published during the broader collection period, this recent activity gap lowers confidence in ongoing maintenance.

Repo issue activitycaution

There were no new or closed issues and no pull requests in the last month, with 5 open issues. This is a mild sign of limited recent project interaction, though it is not evidence of abandonment by itself.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a repository hygiene gap, not evidence that the release is unsafe.

Security policycaution

The repository has no security policy. For an OAuth provider, the absence reduces transparency about vulnerability reporting and response expectations.

Workflow auditcaution

The single workflow was fully analyzed with no audit findings or untrusted triggers, but all 7 of 7 action references are unpinned. That leaves the build exposed to mutable action changes and is a meaningful supply-chain hygiene concern.