sanmai/pipeline

Clear licensing, documentation, testing, and release records make this straightforward to adopt. Keep an eye on continuity because recent work comes from one contributor, while the automated workflows need tightening.

Latest 7.10

Packagist

79%

Total Score

Maintainer Stability

Dependencies

100

Maturity

100

Supply Chain

Health Score Breakdown

Project backing

The repository is owned by an individual rather than an organization, so the single recent contributor represents a genuine continuity risk rather than an organizational handoff opportunity.

Repo bus factor

All 8 recent commits came from one contributor, leaving continuity dependent on a single individual despite the repository remaining active.

Security policy

No security policy was found, which is a transparency gap for reporting vulnerabilities, though the repository does use Dependabot and Psalm.

Workflow audit

All workflows were analyzed with no untrusted checkout or script-injection findings, but all 14 action references are unpinned and a high-confidence template-injection finding remains; top-level write permissions also appear in two workflows.