quasarstream/signaling

Release historycaution

Only two releases exist across roughly 16 months, with the latest published nearly a year before assessment. That limited and slowing cadence creates a real maintenance-continuity concern.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. That is a modest transparency and supply-chain hygiene gap.

Workflow auditcaution

The single workflow uses read-only permissions and has no untrusted checkouts, script injection, or audit findings. However, all three action references are unpinned, leaving avoidable workflow reproducibility risk.