zip/magento2

Licensecaution

The artifact declares OSL-3.0 but its license file is detected as MIT, so the release has a licensing mismatch that should be clarified before adoption.

Repo toolingcaution

Composer build tooling is present, but no security scanning tooling was detected, leaving a modest supply-chain hygiene gap.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response.

Workflow auditcaution

Both workflows were fully analyzed with no untrusted checkouts, script injection, or auditor findings. However, all three action references are unpinned and one workflow grants top-level write permissions; without an untrusted trigger these are hygiene concerns rather than severe risks.