smile-sa/elasticsuite

Registry deprecationcaution

The package is marked abandoned at the package level and has a named replacement, smile/elasticsuite. This materially lowers confidence in adopting this package name even though the linked project remains active.

Repo toolingcaution

Composer build tooling is present, but no repository security-scanning tool was detected. This is a modest transparency and hygiene gap.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

Seven workflows combine pull_request_target with untrusted checkouts, and all 35 analyzed action references are unpinned; the audit also found seven high-confidence conditions that always evaluate true and four ad hoc package installations. These are concrete CI supply-chain and workflow-hygiene concerns, although no script-injection findings were reported.