tey/concierge

Lifecycle scriptscaution

The package runs a post-autoload-dump lifecycle script during installation. This is common Composer behavior but adds install-time execution that consumers should account for.

Release historycaution

Eight releases were published on the package's first observed day, showing active iteration but too little history to establish long-term release stability.

Repo bus factorcaution

All 29 recent commits came from one contributor, creating a concentrated maintenance dependency. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Version stabilitycaution

Version v0.7.0 is not a stable major release, and the README explicitly notes that minor releases may change the API before 1.0.

Workflow auditcaution

All seven workflows were analyzed with no audit findings or untrusted checkouts, but all 22 action references are unpinned and two workflows grant top-level write access. The unpinned actions are a workflow supply-chain hygiene concern, while the write permissions are only a mild concern without an untrusted sink.