tourze/open-ai-contracts

Release historycaution

The package has only two releases, both within a four-day period, followed by roughly ten months without another release. This is limited evidence of sustained maintenance for a package intended as a reusable contract library.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Although the repository is not archived, this is a concrete sign that maintenance may have slowed or stopped.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. That is a modest repository hygiene gap rather than a standalone dependency risk.

Security policycaution

The repository has no security policy. For a contracts-only library this is a transparency gap, but it is less serious than for a package handling credentials or runtime infrastructure.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. However, all three action references are unpinned, leaving build inputs less reproducible and increasing workflow supply-chain exposure.