IgorGanapolsky

package-manager-honesty-doctor

Audit lockfile/packageManager/CI install parity and fail-closed package-manager switches. Steal from InfoQ pnpm 12 (Rust rewrite) — do NOT migrate ThumbGate off npm. Prefer --ignore-scripts honesty. Slash: /package-manager-honesty-doctor.

IgorGanapolsky 26 7 Updated 3d ago
GitHub

Install

npx skillscat add igorganapolsky/thumbgate/package-manager-honesty-doctor

Install via the SkillsCat registry.

About this skill

The skill audits consistency between lockfiles, package manager configurations, and CI installation commands, detecting mismatches and enforcing fail‑closed behavior for package‑manager switches. It is used when a project uses multiple package managers or CI pipelines and needs to verify that npm, pnpm, yarn or bun installations produce identical results and that scripts are handled honestly.

SKILL.md

Package-Manager Honesty Doctor

When

pnpm 12, InfoQ pnpm Rust, migrate to pnpm/yarn/bun, dual lockfiles, CI npm ci vs pnpm, ignore-scripts.

Do

npx thumbgate@1.36.1 package-manager-honesty-doctor --json
npx thumbgate@1.36.1 package-manager-honesty-doctor --propose-switch=pnpm --json

Never

  • Add pnpm-lock.yaml beside package-lock.json
  • Rewrite CI to pnpm casually on this public npm package
  • Treat npm lifecycle scripts as safe by default