css-property-type-validator

Generate or update Dependabot configuration files for projects. Use this skill whenever the user asks to add, create, update, configure, or fix Dependabot for a project — including phrases like "set up Dependabot", "add Dependabot config", "update my dependabot.yml", "enable Dependabot updates", or "configure automated dependency updates". Always apply this skill even if the user only mentions one ecosystem (e.g. "add Dependabot for npm") — the canonical config covers all required ecosystems.

Apply best practices when publishing npm packages, including secure CI/CD workflows, trusted publishing via OIDC, GitHub repository hardening, and supply-chain attack prevention. Use this skill whenever the user asks about publishing an npm package, setting up a publish workflow, configuring GitHub Actions for release automation, managing npm tokens or secrets, setting up changesets, or auditing an existing publishing pipeline for security. Also trigger when the user mentions publint, OIDC trusted publishing, release automation, or package versioning workflows.

Generate, repair, or debug the GitHub Actions workflow FILE that performs an OIDC trusted publish of a pnpm package — the concrete publish.yml, its test → build → publish job shape, the package tarball artifact handoff, Node-version inference from package.json, pnpm setup via pnpm/action-setup, the npm-CLI-version upgrade step, and repository.url/Sigstore provenance matching. Use when the user wants the actual workflow written or fixed, or is debugging a specific CI failure: npm publish E404/E403/422, NODE_AUTH_TOKEN appearing unexpectedly, provenance or id-token errors, pnpm/action-setup version resolution, or actions/setup-node node-version-file problems. For the broader publishing SECURITY POSTURE — account 2FA, repository and branch hardening, GitHub environments, changesets versus changelogithub, sole-maintainer risk, or auditing an existing pipeline — use the npm-package-publishing skill instead.