Verification · Supply chain · Lockfile consistency
Frozen install
Install with the frozen or locked flag so a stale lockfile fails.
How to build it
- Commit the lockfile for every application in the repository.
- Install with the frozen flag in CI, such as npm ci, uv sync --locked or cargo build --locked.
- Make the job fail when the lockfile is missing or out of date.
Signals in a repository
- CI steps that run npm ci, pnpm install --frozen-lockfile or uv sync --locked.
- A committed package-lock.json, uv.lock or Cargo.lock at the repository root.
- Install commands in workflow files that never run a plain install.
In practice
No scanned repository runs a tool for this check. The steps above are the only guidance.