What problem does it solve? Commands like npm install and uv sync silently resolve new dependency versions even when a lockfile exists, causing non-reproducible builds and lockfile drift across CI pipelines, Docker images, and deploy scripts. ## Core Features & Use Cases - Install Site Inventory: Greps the repository for every npm and uv install command across CI workflows, Dockerfiles, Makefiles, task runners, and docs, then classifies each as reproducing or resolving. - Frozen Command Rewrites: Converts resolving commands to frozen equivalents such as npm ci, uv sync --locked, and uv pip sync --require-hashes, with a vocabulary table for pnpm, Yarn, Cargo, Bundler, and more. - Drift Verification: Deliberately manufactures a manifest-lockfile mismatch to prove each rewritten command fails loudly, then confirms it passes on the committed state. - Use Case: A team notices their CI builds occasionally pull different dependency versions than local development. Use this Skill to audit every install site, commit a current lockfile, and rewrite all reproducing sites to frozen commands. ## Quick Start Audit this repository for resolving install commands and replace them with frozen lockfile-based installs in CI, Docker builds, and scripts.
