skills.rest
majedsiefalnasr
majedsiefalnasrCOMMUNITY
Explore all skills by this author →
Website𝕏@majedsiefalnasrGitHub

package-manager-governance

Enforce strict Composer and npm dependency governance with lockfiles and audits.

Updated Apr 10, 2026
Search Tags:#security#npm#audit#composer#dependency-management#lockfile#package-governance
One-click install
npx skills add https://github.com/majedsiefalnasr/bunyan-app-cursor --skill package-manager-governance
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: package-manager-governance
Source: https://github.com/majedsiefalnasr/bunyan-app-cursor/tree/main/.agents/skills/package-manager-governance
Command: npx skills add https://github.com/majedsiefalnasr/bunyan-app-cursor --skill package-manager-governance

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Governance over package managers to ensure deterministic, secure, and auditable dependencies across PHP and Node.js projects, preventing accidental upgrades and unsafe installs.

Core Features & Use Cases

  • Ensures strict version pinning and lockfile-based installs for both Composer and npm.
  • Provides enforced rules for dependency adds, updates, and audits to minimize risk and maintain reproducibility.
  • Use Case: Large multi-team projects requiring consistent environments across CI/CD and developer machines.

Quick Start

Use the governance rules to manage dependencies deterministically and securely across Composer and npm in your project.

Frequently Asked Questions about package-manager-governance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce strict package governance for npm and PHP Composer dependencies?▼

Strict package governance is enforced by requiring deterministic installs, committing lockfiles, and preventing updates without explicit package selection across your CI/CD pipelines. This minimizes risk and maintains reproducible environments.

What is deterministic dependency management and why does it matter for CI/CD pipelines?▼

Deterministic dependency management ensures consistent environments across CI/CD and developer machines by relying on lockfile-based installs and strict version pinning. This prevents accidental upgrades and unsafe installs.

Can I use npm audit and composer audit together for dependency security auditing?▼

Yes, you can use npm audit and composer audit together to enforce audited dependency management. This specifies explicit security requirements and lockfile handling for both frontend and backend projects.

What's the best way to prevent accidental package upgrades in a large multi-team project?▼

The best way to prevent accidental upgrades is applying governance rules that restrict updates without explicit package selection and mandate lockfile commits, ensuring consistent environments for all teams.

Why should lockfiles always be committed when managing PHP and Node.js dependencies?▼

Lockfiles must always be committed to guarantee deterministic installs and maintain reproducibility. This governance rule prevents uncontrolled version drift across different development and pipeline environments.

Related Skills

Explore More Software Engineering Skills→
orangehrmorangehrm
1.1k

dependencies

Manage PHP Composer and Yarn dependencies within the OrangeHRM Docker environment.

Official
Intermediate
AgentSecOpsAgentSecOps
183

api-spectral

Lint OpenAPI/AsyncAPI definitions with Spectral to enforce security and governance rules.

Official
Advanced
yalehyaleh
21

Dependency Health

Audit and prioritize software dependencies for security vulnerabilities across ecosystems.

Community
Advanced
Ankh-StudioAnkh-Studio

enterprise-github-hooks-orchestrator

Configure and manage GitHub hooks for pre-commit, commit-msg, pre-push, and post-commit workflows.

Official
Advanced