Instructions

When to Use

• Use for lockfiles, audits, install-script policy, CI gates.
• Prefer dependency-migrations for major version upgrade plans.
• Prefer github-actions-ci to implement the CI jobs.

Improve dependency hygiene and supply-chain posture for a Node repo (prefer pnpm).

1. Confirm lockfile is committed and CI uses frozen install (pnpm install --frozen-lockfile).
2. Add or verify audit on PR (pnpm audit --audit-level=high or org standard); document exit code policy.
3. Enable dependency review on lockfile PRs when on GitHub - link to org setting if missing.
4. Lifecycle scripts: evaluate ignore-scripts / pnpm trusted dependency builds; list packages that truly need postinstall.
5. New deps: require justification, scoped name when possible, link to repo + last release date.
6. Pair with dependency-migrations for majors - never stack unrelated major bumps.

Outcomes

• Markdown policy section + optional .npmrc / workflow snippet titles (user pastes content).