swoft-fork/annotation

Tests, a readable package guide, and a matching Apache-2.0 license provide useful adoption basics. The lack of recent development and fully unpinned workflow actions make long-term maintenance and build integrity uncertain.

Latest v2.1.0

Packagist

45%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has only one release, published about 1 year and 9 months ago, with no releases in the last 12 months. This provides little evidence of ongoing maintenance.

Repo commit activity

The repository recorded no commits and no active maintainers in the last 3 months, reinforcing the risk that this fork is no longer being maintained.

Repo popularity

The linked repository has zero stars, forks, and watchers. Popularity is not required for a healthy package, but these values provide no supporting evidence of an active user or maintainer community.

Security policy

The repository has no security policy, which reduces transparency about reporting and handling vulnerabilities. The package's license and test coverage provide some project structure but do not replace this process documentation.

Workflow audit

Both workflows were analyzed successfully and contain no dangerous triggers, untrusted checkouts, or script-injection findings. However, all 5 action references are unpinned, leaving workflow dependencies less reproducible and increasing update risk.