# Dependency CI Contract

> Keep dependency and lockfile changes aligned with CI expectations.

- Skill: `zaxbyhub/dependency-ci-contract` (Agent Skill)
- Install (CLI): `npx skillmds@latest add zaxbyhub/dependency-ci-contract`
- Raw SKILL.md: https://api.skillmd.com/api/skills/zaxbyhub/dependency-ci-contract/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: zaxbyhub (https://skillmd.com/u/zaxbyhub)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/zaxbyhub/dependency-ci-contract

---


# Dependency and CI Contract

## Trigger

- Changing dependency versions
- Updating package.json
- Regenerating lockfiles
- Investigating test/build failures after dependency changes

## Required Procedure

- Run typecheck and build locally and confirm they pass before presenting code for review.
- Verify node_modules matches the lockfile before reporting test failures.
- Re-run failed CI gates after dependency sync before escalating.

## Forbidden Shortcuts

- Change dependency versions that cause typecheck or build to fail.
- Report test failures as code defects before confirming the environment matches the lockfile baseline.

## Delegation Template

When delegating a task affected by this skill, include:

```
SKILLS: file:.opencode/skills/generated/dependency-ci-contract/SKILL.md
```

## Reviewer Checks

- Verify typecheck and build pass after dependency changes.
- Verify environment consistency before approving failure attribution.

## Test Engineer Checks

- Confirm node_modules hash matches baseline before running tests.
- Confirm TypeScript version matches project requirement before trusting test results.
- Run the test suite on a clean install before flagging implementation as the cause of test failure.

## Source Knowledge IDs

- f178f314-bce2-474b-bb4f-091d6662b5f7 — Dependency version changes must not break CI gates. If typecheck or build cannot run after a change, the change is invalid and must be reverted before review.
- d38f4988-551c-4d4d-b4b2-be6dc0d75c30 — Run `npm ci` or verify lockfile sync before attributing test/build failures to code changes; missing dependencies produce spurious failures that waste review cycles.