milpa/data

Runtime-native persistence primitive for the Milpa PHP framework: a plain-entity + repository contract, with file-JSON, SQLite and MySQL document-store, and in-memory backends behind a common RepositoryInterface — zero ORM, zero migrations.

Latest v0.3.3

Packagist

74%

Total Score

caution

Active releases and organization backing offset single-contributor maintenance and unpinned workflow actions.

Health Score Breakdown

Repo bus factor

All 14 recent commits came from one contributor, creating a meaningful continuity risk even though the repository is owned by an organization.

Repo tooling

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest transparency and maintenance gap.

Version stability

v0.3.3 is not a prerelease, but the package remains below 1.0, so its public API and compatibility expectations are less mature than a stable-major release.

Workflow audit

All four workflows were analyzed with no reported audit findings or untrusted checkout and script-injection paths. However, all 8 action references are unpinned and 3 workflows grant top-level write permissions, which is avoidable workflow hygiene risk without an observed untrusted trigger.