builderio/figma-html: technical due diligence, read from its repository

Of five ordinary markers — CI workflows, CODEOWNERS, a pull-request template, pre-commit hooks, contribution guidance — 1 is present: CODEOWNERS. Branch protection itself is a GitHub setting rather than a file, so this is a reading of proxies and not of the rules themselves. What it does establish is that the process is not written down anywhere a new engineer would find it.

Five files out of 117 absorb 37% of all file-level change. Concentration like this is where debt is usually being serviced rather than repaid: the same code is reopened because it is load-bearing, fragile, or both. A repository cannot tell you which — that is a conversation with the team.

Deleted lines per line added rose from 0.62 to 3.27 between the first and second halves of this history. Rework is normal and often healthy, but a rising ratio means an increasing share of the team's time is spent replacing code that already exists rather than building what does not. Whether that is deliberate repayment or churn is a question for the team.

The code is pinned to Node.js 16 (end of life 2023-09-11). None of these receives security fixes any more; the first stopped on 2023-09-11. Moving off an unsupported runtime is rarely a one-line change, so a buyer should ask whether the upgrade is planned and what it touches.