skills.rest
cgfixit
cgfixitCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

dep-sync

Synchronizes Cargo manifests, lockfiles, toolchain pins, and CI config against origin/main.

Updated Sep 7, 2026
Search Tags:#rust#cargo#toolchain#lockfile#cargo-deny#dependency sync#ci config
One-click install
npx skills add https://github.com/cgfixit/CG-agent-harness --skill dep-sync-cgfixit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dep-sync
Source: https://github.com/cgfixit/CG-agent-harness/tree/main/.claude/skills/dep-sync
Command: npx skills add https://github.com/cgfixit/CG-agent-harness --skill dep-sync-cgfixit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Branches in the CG-Agent-Harness repository drift behind origin/main on dependency versions, Rust toolchain pins, cargo-deny policy, and CI/release configuration, causing build failures and stale security posture. This Skill detects that drift and applies the actual fixes rather than only reporting them. ## Core Features & Use Cases - Drift Detection: Diffs Cargo.toml, Cargo.lock, rust-toolchain.toml, deny.toml, GitHub workflow YAML, and packaging scripts against origin/main or the branch's upstream. - Two-Crate Sync: Updates the backend (Rust 1.88) and desktop (Rust 1.90) crates independently, regenerating each Cargo.lock and running cargo deny check for both. - Re-Verification: Rebuilds, formats, lints with clippy, and runs the full test suite after syncing, while respecting deliberate pins documented in docs/DEPENDENCIES.md. - Use Case: After a security advisory lands on main, run this Skill on a stale feature branch to pull in the updated dependency versions, toolchain strings, and CI job definitions, then verify everything still builds and passes tests. ## Quick Start Ask the AI to sync this branch's dependencies and toolchain state with origin/main and fix any dependency drift.

Frequently Asked Questions about dep-sync

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I fix dependency drift between a branch and main in a Rust project?▼

Fetch origin/main, diff Cargo.toml, Cargo.lock, rust-toolchain.toml, deny.toml, and workflow files against the base ref, then apply the semantic changes. Regenerate lockfiles with cargo update rather than hand-editing, and re-verify with build, clippy, and cargo deny check.

What is the difference between dep-sync and cgagentharness-verify-deps?▼

cgagentharness-verify-deps only checks and reports dependency drift without making changes. dep-sync performs the actual sync: it updates Cargo.lock, rust-toolchain.toml, deny.toml, and CI YAML to match origin/main, then re-verifies the result.

Can I sync Rust toolchain versions independently for backend and desktop crates?▼

Yes. The backend (root, Rust 1.88) and desktop (desktop/, Rust 1.90) crates have separate rust-toolchain pins and Cargo.lock files, and desktop is not a workspace member. A bump to one pin must not leak into the other.

Should I hand-edit Cargo.lock to fix version drift?▼

No. Lockfile changes follow from manifest changes, so regenerate Cargo.lock with cargo update --locked after reviewing a dry-run against what origin/main's diff requires. Hand-editing a lock file risks inconsistent resolution.

When should I not add a cargo deny advisory exception?▼

Never add an advisory exception to silence a finding that the sync itself introduced. Fix the dependency version instead. Deliberate pins documented in docs/DEPENDENCIES.md that origin/main still carries are not drift and should be left untouched.

Related Skills

Explore More Software Engineering Skills→
zmerlynnzmerlynn
19

pr

Rebase, build, lint, test, and open a pull request against main.

Community
Advanced
hatch3rhatch3r
26

hatch3r-pr-creation

Create platform-native pull requests or merge requests following repository conventions.

Official
Advanced
SpreadWorksSpreadWorks
2

sdd-forge.flow-sync

Sync documentation with the current codebase using the sdd-forge CLI.

Official
Advanced
ChatAndBuildChatAndBuild
1

dependency-upgrade

Automate dependency upgrades with compatibility checks and changelog reviews.

Official
Advanced