Awesome Reviewers

Verification · Supply chain

Lockfile consistency

Fails when the lockfile no longer matches the manifest, so CI installs exactly what was reviewed.

Sub-techniques

  • Frozen install V1016.001

    Install with the frozen or locked flag so a stale lockfile fails.

  • Lock check V1016.002

    Regenerate the lock and fail on any diff.

How to build it

  1. Commit lockfiles for applications.
  2. Use frozen installs in CI (npm ci, uv sync --locked, cargo build --locked).
  3. Add an explicit lock check step for clearer failures.

Signals in a repository

  • --frozen-lockfile, --locked or npm ci in CI.
  • uv lock --check or a lockfile diff step.