pin-a-dependency-version
Pin a dependency through the project's package and lockfile conventions while preserving reproducible resolution and update intent. Use when uncontrolled version drift can change builds or runtime behavior.
来源信息
- 仓库
- protosphinx/sphinxstack
- 最近来源活动
- 2026年7月29日 13:55
- 检测到的 SKILL.md 语言
- 英语
- 星标
- 3
- Forks
- 0
安装方式
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
检查来源文件
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
文件资源管理器
2 个文件正在显示 SKILL.md
SKILL.md
来源说明 · 只读预览- name
- pin-a-dependency-version
- category
- code
- description
- Pin a dependency through the project's package and lockfile conventions while preserving reproducible resolution and update intent. Use when uncontrolled version drift can change builds or runtime behavior.
# pin-a-dependency-version
Pin through the package manager, not by editing resolved files blindly.
## When to use
- Use for direct, transitive, toolchain, image, action, or runtime dependencies.
- Do not pin a vulnerable version merely to make a test pass or bypass supported upgrade requirements.
## Procedure
1. Identify dependency, current source, direct or transitive status, affected environments, and reason for the pin.
2. Check project policy, package-manager semantics, supported versions, advisories, and upstream release notes.
3. Choose the narrowest stable version rule that meets the reproducibility need.
4. Update manifest, override or resolution, and lockfile with the approved package manager.
5. Verify checksums, registry source, signatures or provenance where available, and no unexpected dependency changes.
6. Run install from a clean cache plus relevant build, test, and runtime checks.
7. Document why the pin exists, owner, removal condition, and update review date.
## Done
- Manifest and lockfile resolve the intended dependency version from the approved source without unrelated changes
- Clean installation, build, tests, advisory review, and pin-removal record are completed
在 GitHub 查看