thoughtsideas/wp-infrastructure

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, which adds execution during dependency operations and deserves review before adoption. No provided signal shows these scripts are unsafe, so this is a limited transparency and operational concern rather than a severe risk.

Repo bus factorcaution

All recent commits came from one contributor, creating a concentrated maintenance dependency. The organization-owned repository provides some handoff potential, but no second active contributor is shown.

Repo commit activitycaution

There were three commits in the last 3 months, showing ongoing work, but only one active maintainer contributed them, so maintenance capacity is limited.

Token permissionscaution

The only workflow lacks top-level token permissions. No write permissions are explicitly declared, but the missing restriction leaves workflow access less tightly documented than preferred.

Version stabilitycaution

Version 0.3.1 is not a prerelease, but the pre-1.0 version indicates that API changes may still occur during the project's alpha/beta stage.