Which has better activity and maintenance signals?

Based on the RepoPilot analysis, trunk-rs/trunk has significantly better maintenance signals.

trunk-rs/trunk receives a "GO" verdict with strong maintenance signals. While its architecture grade is C (63/100) with some circular dependencies, it shows:

• 0 critical/high/moderate CVEs across 75 scanned dependencies
• Active CI/CD (Build Status badge in README)
• 4,389 stars and 323 forks indicating community adoption
• Dependency security: clean across direct dependencies

tw93/pake, by contrast, lacks a RepoPilot verdict summary in the provided data. The available signals show:

• Stricter version coordination requirements (4 files must stay in sync per release per [CLAUDE.md:L148-L166])
• Lower apparent download visibility in the data provided
• More complex release management (tag filtering, special handling for legacy tags like continuous)

Key distinction: Trunk's analysis explicitly includes OpenSSF Scorecard metrics (4.4/10, though weak on Security-Policy and SAST), while Pake's security posture isn't characterized in the provided signals. Trunk also shows more transparency in its dependency advisory scanning results.

For maintenance activity specifically, Trunk appears to have:

• Regular dependency updates (reflected in the CI badge)
• Documented release processes
• Clear configuration and build systems

Pake requires more manual coordination across multiple version files, suggesting potentially more friction in the release workflow.

FOLLOW_UPS:

• What security concerns does Trunk's C-grade architecture raise?
• How many circular dependencies exist in trunk-rs/trunk?
• Does Pake have OpenSSF Scorecard or security scanning data?