voku/php-hooks

Clear licensing, documentation, tests in the repository, and a minimal dependency set support adoption. Maintenance is concentrated in one recent contributor, while unpinned workflow actions weaken build integrity.

Latest 0.2.12

Packagist

67%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made all commits during the last three months, giving the project a concentrated short-term bus factor. The linked repository is user-owned rather than organization-owned, so there is no shown organizational handoff to offset it.

Repo commit activity

Only one commit was recorded in the last three months, by one active maintainer. The recent activity is positive but indicates a very thin maintenance cadence.

Security policy

The repository has no published security policy. This is a transparency gap, although the repository's listed security-scanning tools provide some compensating hygiene.

Version stability

Version 0.2.12 is not a stable-major release, so its pre-1.0 status leaves more room for compatibility changes. It is not marked as a prerelease, which partly offsets that concern.

Workflow audit

The only workflow was fully analyzed, uses read-only permissions, and has no dangerous triggers or audit findings. However, all four referenced actions are unpinned, weakening build reproducibility and protection against action changes.