shopwell/docker

Build tooling and documentation are present, and the repository is clearly tied to the package. The license files identify both Apache-2.0 and MIT while the manifest declares only Apache-2.0; workflow permissions and unpinned actions also need attention.

Latest 0.3.0

Packagist

64%

Total Score

Maintainer Stability

100

Maturity

Supply Chain

Health Score Breakdown

License

The manifest declares Apache-2.0 and license files are present, but the artifact also detects MIT text, creating a licensing mismatch that should be clarified.

Release history

This is the package's first release, published today, so there is no release track record or demonstrated cadence yet. That limits maturity evidence for a dependency.

Security policy

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Version stability

Version 0.3.0 is not a stable major release, which signals an early-stage API and greater compatibility risk for consumers.

Workflow audit

All seven workflows were analyzed, but four use top-level write permissions and 25 of 35 action references are unpinned. The high-confidence template-injection finding is workflow hygiene concern on its own, without an untrusted trigger or checkout sink.