sympress/asset-compiler

Release historycaution

The package is young at 96 days old and has only two releases, so its long-term maintenance record is still limited; the four-day median interval shows initial follow-through.

Repo bus factorcaution

All five recent commits came from one contributor, creating a meaningful continuity risk; organization backing provides some capacity for handoff but does not remove the concentration.

Workflow auditcaution

The workflow was fully analyzed, uses read-only permissions, and has no detected dangerous sinks or audit findings. Both of its action references are unpinned, a moderate reproducibility and supply-chain hygiene gap.