libresign/nextcloud-behat

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, which adds install-time behavior that consumers should understand, but this is not by itself a severe health concern.

Maintainerscaution

Only one registry account has publishing access, which is a concentration risk, though the linked repository is organization-owned and active.

Repo bus factorcaution

One contributor made all 5 commits in the last three months, creating a high individual concentration risk. Organization backing partly compensates because maintenance can potentially be handed off.

Security policycaution

The repository has no security policy, which is a transparency gap for reporting vulnerabilities, although the package does use security scanning tools.

Workflow auditcaution

All 8 analyzed action references are unpinned, weakening build reproducibility and action supply-chain control. The audit found no dangerous triggers, sinks, or high-confidence workflow findings, and all workflows were analyzed successfully.