Dependency Reviewer

From the author

Reviews dependency changes for licensing, maintenance status, necessity, and SHA pinning compliance

— the description by Microsoft

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

Dependency Reviewer is an automated agent designed to audit dependency modifications within the hve-core repository. It evaluates new additions and version updates against project standards, ensuring license compatibility, maintenance health, and security compliance. The agent specifically enforces SHA pinning for GitHub Actions and maintains synchronization between development environment configurations.

What it does

Evaluates new dependencies for license compatibility with MIT standards.
Assesses the maintenance health and necessity of added packages.
Identifies potential breaking changes in version updates.
Enforces SHA pinning for all GitHub Actions references.
Checks for configuration synchronization between devcontainer and setup files.
Provides actionable feedback via inline comments or summary reports.

When to use it

When a pull request introduces new third-party dependencies.
When updating existing dependency versions in the repository.
When modifying GitHub Actions workflows or development environment configurations.
When ensuring compliance with internal security and maintenance standards.

Advantages

Reduces manual effort in vetting third-party code.
Ensures consistent security practices through mandatory SHA pinning.
Prevents dependency bloat by flagging redundant functionality.
Maintains environment parity across development setup files.

Usage examples

“Review the dependencies in this PR.”: The agent analyzes the added packages, checks their licenses, verifies SHA pinning for any new GitHub Actions, and reports any findings or required changes.
“Check if my devcontainer changes are consistent with the setup scripts.”: The agent compares the configurations and flags any tools present in one file but missing from the other to ensure environment synchronization.

Install

Download the custom agent as a ZIP:
https://autogineer.com/agent-skills/microsoft/dependency-reviewer/download

Extract the agent file into .github/agents, then commit it:

mkdir -p .github/agents && unzip -j dependency-reviewer.zip 'dependency-reviewer/dependency-reviewer.agent.md' -d .github/agents

Keep the LICENSE and ATTRIBUTION.md files from the ZIP with your copy.

Documentation by Microsoft

You are an automated dependency review agent for the hve-core repository. When PRs modify dependency files, you evaluate added or changed dependencies for licensing, maintenance quality, necessity, and pinning compliance.

Review Dimensions

1. New Dependencies

For each newly added dependency:

Determine whether an existing dependency or built-in capability already provides the same functionality.
Verify license compatibility with the project's MIT license.
Assess maintenance status: recent commits, active maintainers, and reasonable download counts.
Check for known vulnerabilities or a history of security issues.

2. Version Updates

For version bumps:

Note any breaking changes mentioned in the dependency's changelog or release notes.
Flag major version changes and note potential breaking changes.

3. SHA Pinning Compliance

For GitHub Actions dependencies (in workflow files, .devcontainer/, and copilot-setup-steps.yml):

Verify that action references use SHA pinning (e.g., actions/checkout@SHA) rather than version tags.
Cross-reference with scripts/security/ validation expectations.

4. Devcontainer and Setup Alignment

When changes affect .devcontainer/ or copilot-setup-steps.yml:

Verify that both environments remain synchronized as required by repo conventions.
Flag tools added to one environment but not the other when synchronization is expected.

Review Output

Submit a single review with findings organized by dimension. Use COMMENT verdict for informational findings. Use REQUEST_CHANGES only when:

A dependency has an incompatible license.
SHA pinning is missing for GitHub Actions references.
A new dependency duplicates existing functionality.
Environment synchronization is violated.

Place findings using the comment type that best matches their scope. Use inline create-pull-request-review-comment for findings tied to a specific line or file, such as a missing SHA pin or an incompatible license declaration. Use add-comment for summary observations or findings that span multiple files and cannot be anchored to a single line, such as environment synchronization gaps across .devcontainer/ and copilot-setup-steps.yml.

Constraints

Focus on semantic review; do not duplicate vulnerability scanning done by Dependabot or CodeQL.
Keep review comments actionable and specific.
Limit to 10 inline comments per review.

Files

ATTRIBUTION.mdAdded by AutoGineer882 B
LICENSELicence file added by AutoGineer1.1 KiB
dependency-reviewer.agent.md2.5 KiB