skills.rest
SpineEventEngine
SpineEventEngineOFFICIAL
Explore all skills by this author →
Website𝕏@SpineEngineGitHub

dependency-audit

Audit buildSrc dependency declarations for version downgrades, BOM mismatches, and convention drift.

2|Updated May 28, 2021
Search Tags:#dependency audit#deprecation checks#version sanity#BOM validation#Kotlin buildSrc#convention drift#Gradle tooling
One-click install
npx skills add https://github.com/SpineEventEngine/validation --skill dependency-audit-spineeventengine
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dependency-audit
Source: https://github.com/SpineEventEngine/validation/tree/main/.agents/skills/dependency-audit
Command: npx skills add https://github.com/SpineEventEngine/validation --skill dependency-audit-spineeventengine

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It prevents accidental breaks and hidden instability by auditing dependency declaration changes, especially downgrades, BOM/version mismatches, and convention drift in the repo’s buildSrc dependency catalog.

Core Features & Use Cases

  • Version sanity checks: Detects semver downgrades and snapshot regressions in dependency version declarations.
  • BOM ↔ component agreement: Verifies that DependencyWithBom artifacts keep BOM and component versions aligned.
  • Deprecation discipline & caller safety: Ensures renamed/removed constants keep proper @Deprecated guidance and that no call sites are left behind.
  • Convention drift detection: Flags stale copyright years, missing URL comments, and missing constant-object suppression.
  • Cross-cutting guardrails: Checks that local/ vs lib/ vs test/ dependency boundaries aren’t violated and that Gradle DSL usage stays consistent.

Quick Start

Use dependency-audit whenever a diff touches buildSrc dependency declarations under buildSrc/src/main/kotlin/io/spine/dependency/ or when asked to audit a dependency bump, and run it against the unified diff rather than re-scanning unrelated code.

Frequently Asked Questions about dependency-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect silent version downgrades in a Gradle dependency catalog?▼

You can detect silent version downgrades by auditing dependency declarations for semver regressions and snapshot version drops, preventing accidental instability without running builds.

How do I validate BOM and component version alignment in Gradle?▼

Validating BOM and component version alignment in Gradle requires checking DependencyWithBom artifacts to ensure both versions stay synchronized across dependency catalog changes.

What is convention drift in buildSrc dependency catalogs?▼

Convention drift in buildSrc dependency catalogs refers to accumulating stale copyright years, missing URL comments, and improper constant-object suppression patterns that violate repository standards.

Does dependency auditing catch missing deprecation markers for renamed constants?▼

Dependency auditing does catch missing deprecation markers by validating that renamed or removed constants retain proper @Deprecated guidance and verifying no call sites are left behind.

Can I audit a dependency bump without running a full build?▼

You can audit a dependency bump without running a full build by analyzing the unified diff of buildSrc dependency declarations to check version sanity and boundary violations.

What are the limitations of auditing dependency declarations via unified diffs?▼

Limitations include relying solely on the diff context, meaning unrelated code is not re-scanned, and the audit requires changes to specifically touch the buildSrc Kotlin dependency directory.

Related Skills

Explore More Software Engineering Skills→
SpineEventEngineSpineEventEngine
2

dependency-update

Update Gradle dependency version constants in Kotlin objects and generate a Markdown report.

Official
Advanced
JetBrainsJetBrains
302

gradle-kotlin-dsl-doctor

Diagnose and patch Kotlin Spring Gradle build failures with minimal changes.

Official
Advanced
dotBeepsdotBeeps

kotlin

Enforce Kotlin conventions across source files and Gradle Kotlin DSL scripts.

Community
Advanced
skylarsaboskylarsabo

supply-chain-trust

Audit software supply chain dependencies for egress, CVEs, and build integrity.

Community
Advanced