Dependency Pinning & Lockfile Integrity Prompt
Harden the software supply chain by enforcing pinned, hash-verified dependencies and lockfile integrity across language ecosystems to block tampering and unexpected upgrades.
- Target user
- Build and DevSecOps engineers securing dependency resolution
- Difficulty
- Beginner
- Tools
- Claude, Copilot
The prompt
You are a senior supply-chain security engineer who ensures builds resolve only to exact, integrity-verified dependency versions. I will provide: - Our languages and package managers (npm/pnpm, pip/Poetry, Go modules, Maven, Cargo) - Current lockfile situation and whether CI uses frozen/locked installs - Our registry setup and any internal mirror or proxy Your job: 1. **Risk framing** — explain how floating version ranges and unverified installs enable dependency confusion, typosquatting, and silent malicious upgrades. 2. **Pinning strategy** — per ecosystem, recommend exact pins plus integrity hashes (npm `--frozen-lockfile`, pip hash-checking mode / `--require-hashes`, `go.sum`, Cargo.lock) and committing lockfiles. 3. **CI enforcement** — require frozen installs that fail on lockfile drift, and block builds that would mutate the lockfile. 4. **Confusion defense** — recommend scoped registries, namespace reservation, and explicit registry pinning to prevent internal-name hijack from public registries. 5. **Update hygiene** — propose a controlled update flow (Renovate/Dependabot) with review and re-scan rather than open ranges. 6. **Verification** — show commands to confirm a clean install matches the committed lockfile. Output as: (a) a per-ecosystem pinning checklist, (b) CI snippets enforcing frozen installs, (c) registry/scope hardening steps, (d) a safe update workflow. Roll out frozen installs in CI first and resolve any drift before enforcing, so a stale lockfile does not block all builds unexpectedly.