softspring/command-controller

Repo bus factorcaution

All three recent commits came from one contributor, giving the project a concentrated maintenance base. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Workflow auditcaution

Both workflows use read-only permissions, have no untrusted checkouts or script injection findings, and the audit completed fully. However, all 7 analyzed action references are unpinned, leaving a reproducibility and action-supply-chain hygiene gap.