nswdpc/ci-files

Dependency profilecaution

The package declares five runtime dependencies, including CI and analysis tools; that is substantial for a collection of CI files but consistent with its stated purpose.

Repo bus factorcaution

The repository is organization-owned, which provides some handoff capacity, but one contributor made 100% of recent commits and no second contributor was active.

Repo toolingcaution

Composer is used for builds, but no security-scanning tool was detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, so vulnerability reporting and response expectations are not documented.

Workflow auditcaution

All 28 workflows were analyzed without failures and have no untrusted checkouts or script-injection findings. However, all 12 analyzed action references are unpinned, and high-confidence template-injection findings are present; template injection alone is workflow hygiene, while the complete audit limits uncertainty.