swoft-fork/validator

It includes a readable guide, tests, and a matching Apache-2.0 license. Its small dependency surface and lack of install scripts reduce integration risk, but the workflows use five unpinned actions.

Latest v2.1.0

Packagist

40%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

Only two releases were published, both on December 18, 2024, and there were no releases in the following 12 months. This indicates a release line that has effectively stopped progressing.

Repo commit activity

The repository had zero commits and zero active maintainers in the last three months, consistent with the long release gap and the package README's warning that active maintenance is not guaranteed.

Repo popularity

The repository has zero stars, forks, and watchers, offering no supporting evidence of a broader user or maintainer community. Popularity is only supporting evidence, so this reinforces rather than determines the score.

Security policy

The linked repository has no security policy. This is a transparency and vulnerability-reporting gap, though it is secondary to the stronger evidence of inactive maintenance.

Workflow audit

Both workflows were analyzed without high-confidence audit findings or untrusted checkout and script-injection paths. However, all five action references are unpinned, leaving avoidable build reproducibility and action-update risk.