notauniondev/migrations

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months, which weakens evidence of current maintenance despite the recent release history.

Repo popularitycaution

The repository has zero stars, forks, and watchers, providing little external evidence of adoption or community support. Organization backing and the package's long release history partly compensate, but not fully.

Repo toolingcaution

Composer and Box are used for the build, which is positive, but no security-scanning tools were detected. That leaves a meaningful repository hygiene gap.

Security policycaution

The repository has no security policy, so consumers have no documented vulnerability-reporting process. This is a transparency gap, though it does not by itself make the release unfit.

Workflow auditcaution

All 15 analyzed action references are unpinned, and two workflows use high-confidence unpinned container images, including a floating latest tag. The audit completed fully and found no untrusted checkout or script-injection path, but the release automation remains exposed to mutable build inputs.