violinist-dev/process-factory

Release historycaution

The package has only three releases since February 2019, with no release in the last 12 months and a median interval of about 2 years 9 months. The latest release is documented with GitHub release notes, which helps transparency but does not offset the slow cadence.

Repo commit activitycaution

There were no commits and no active maintainers in the three months before collection, indicating that maintenance is currently inactive. The September 2024 push and the package's small scope provide some context but not recent upkeep.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For a small interface library this is a modest transparency and maintenance gap, not a severe risk by itself.

Workflow auditcaution

The single workflow was fully analyzed and has no dangerous triggers, untrusted checkouts, or audit findings, but both of its two action references are unpinned. That leaves avoidable update and provenance risk without evidence of an active exploit path.