lyhty/macros

Repo bus factorcaution

All four recent commits came from one contributor, leaving maintenance dependent on a single active developer. Organization backing provides some handoff capacity but does not remove the current concentration.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected; this is a modest transparency and maintenance gap rather than evidence of unsafe code.

Workflow auditcaution

The workflow was fully analyzed and uses read-only permissions with no dangerous sinks or audit findings, but both action references are unpinned, leaving them exposed to upstream changes.