yayasanvitka/azure-oauth2-validator

Maintainerscaution

Only one registry account has publishing access, which limits publishing redundancy. The organization-owned repository provides some backing, but administrative ownership does not demonstrate multiple active maintainers.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. The release pushed on May 18, 2026 partly offsets this, but the short-term maintenance signal remains weak.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. For an OAuth token-validation library, that is a meaningful hygiene gap rather than a release-blocking risk.

Workflow auditcaution

Both workflows were analyzed successfully with no untrusted checkouts, script injection, or high-confidence audit findings, and neither grants top-level write access. However, all 8 action references are unpinned, so workflow dependencies can drift and are less reproducible.