阅读中文版本

Release Dependency Pinning Workflow

Freeze dependency versions before a release, verify the locked build, and record the resolved dependency set.

Overview

Make a release reproducible by pinning and recording all dependency versions.

This workflow is reusable across teams and environments; adapt the commands to your tooling while keeping the sequence and checkpoints intact.

Environment and prerequisites

• A lockfile-based package manager
• A CI build
• A software bill of materials tool

Procedure

1. Freeze new dependency changes

Stop adding or bumping dependencies once the release candidate is cut.

Expected state: The dependency set is stable for the release.

2. Rebuild from the lockfile

Build using only locked versions and verify integrity hashes.

Expected state: The build uses exactly the locked versions.

3. Generate an SBOM

Produce a software bill of materials for the resolved dependency set.

Expected state: An SBOM lists every shipped component with versions.

4. Attach the SBOM to the release

Publish the SBOM with the release artifacts for downstream consumers.

Expected state: Consumers can audit what shipped.

npm ci --ignore-scripts
npx @cyclonedx/cyclonedx-npm --output-file sbom.json

Verification

Rebuild from the lockfile and confirm identical output, then verify the SBOM matches the installed tree.

Decision points

Auto-merge dependency bots during freeze?

• Pause dependency updates
• Keep merging

Recommendation: Pause dependency changes during the freeze to keep the release set stable.

SBOM format?

• SPDX or CycloneDX
• Custom list

Recommendation: Use a standard format so scanners and consumers can parse it.

Common failures

• Floating versions make builds non-reproducible.
• Missing SBOM slows vulnerability response.
• Auto-merged updates during freeze destabilise the release.