phplrt/parser-builder

Repo bus factorcaution

All 32 recent commits came from one contributor, leaving maintenance continuity dependent on a single active developer. Organization backing provides some handoff capacity but does not remove the concentration risk.

Repo toolingcaution

Composer build tooling is present, but no repository security-scanning tool was detected, leaving a modest transparency and assurance gap.

Security policycaution

The repository has no security policy, so vulnerability reporting and response expectations are not documented.

Workflow auditcaution

Both workflows were fully analyzed with no untrusted checkouts, injection findings, or write-wide permissions. However, all seven action references are unpinned, weakening build reproducibility and making this a workflow-hygiene concern.