# Dependency Release Guard

> Review dependency updates, package manager files, lockfiles, CI workflows, release scripts, generated artifacts, and publish steps for regressions and supply-chain risk. Use when maintainers are preparing releases, reviewing Dependabot/Renovate PRs, updating packages, or checking build and publish automation.

- Skill: `435867311/dependency-release-guard` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add 435867311/dependency-release-guard`
- Raw SKILL.md: https://api.skillmd.com/api/skills/435867311/dependency-release-guard/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: 435867311 (https://skillmd.com/u/435867311)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/435867311/dependency-release-guard

---


# Dependency Release Guard

Use this skill before merging dependency changes or publishing releases.

## Review Workflow

1. Identify changed dependency surfaces:
   - manifest files
   - lockfiles
   - CI workflow files
   - build scripts
   - release scripts
   - generated artifacts
   - package registry metadata
2. Check whether the change affects runtime, development, build, test, or publish behavior.
3. Inspect scripts that can execute automatically:
   - `preinstall`, `install`, `postinstall`
   - `prepare`, `prepublishOnly`, `release`
   - CI and deployment steps
4. Look for risk signals:
   - new transitive dependency with broad permissions
   - lockfile churn unrelated to the stated update
   - unpinned GitHub Actions or container images
   - package name confusion or registry changes
   - generated files changed without source changes
   - release credentials used in overly broad contexts
5. Recommend validation:
   - install from a clean checkout
   - run unit tests
   - run build
   - inspect package contents before publish
   - dry-run release if supported

## Output Format

```text
Release Risk
- Low/Medium/High and why.

Findings
- file:line - concrete risk or regression.

Required Checks
- commands or review steps to run before merge/release.

Maintainer Recommendation
- merge, block, or request changes.
```

Do not recommend publishing, deploying, or pushing tags unless the maintainer explicitly requested that action and the required checks passed.