Dependency Release Guard

Dependency Release Guard

Use this skill before merging dependency changes or publishing releases.

Review Workflow

1. Identify changed dependency surfaces:
   • manifest files
   • lockfiles
   • CI workflow files
   • build scripts
   • release scripts
   • generated artifacts
   • package registry metadata
2. Check whether the change affects runtime, development, build, test, or publish behavior.
3. Inspect scripts that can execute automatically:
   • preinstall, install, postinstall
   • prepare, prepublishOnly, release
   • CI and deployment steps
4. Look for risk signals:
   • new transitive dependency with broad permissions
   • lockfile churn unrelated to the stated update
   • unpinned GitHub Actions or container images
   • package name confusion or registry changes
   • generated files changed without source changes
   • release credentials used in overly broad contexts
5. Recommend validation:
   • install from a clean checkout
   • run unit tests
   • run build
   • inspect package contents before publish
   • dry-run release if supported

Output Format

Release Risk
- Low/Medium/High and why.

Findings
- file:line - concrete risk or regression.

Required Checks
- commands or review steps to run before merge/release.

Maintainer Recommendation
- merge, block, or request changes.

Do not recommend publishing, deploying, or pushing tags unless the maintainer explicitly requested that action and the required checks passed.