sitepark/github-composer-release-test

Lifecycle scriptscaution

A post-install-cmd script runs during installation, adding execution-time behavior that consumers must trust and understand; no provided signal shows this is necessary or narrowly scoped.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, indicating a recent maintenance pause for a package that continues to publish releases.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented; Dependabot provides some compensating monitoring but not a reporting process.

Workflow auditcaution

All four workflows were analyzed with no detected injection or high-confidence audit findings, and one scopes permissions at job level. However, all four action references are unpinned, so workflow dependencies can change without a reviewed commit.