Agent Skills › zeabur-oss/zeabur › zeabur-dependencies

zeabur-dependencies

GitHub

管理Zeabur项目中Rust和Web依赖的添加与升级，遵循特定供应链政策。涵盖许可证合规、unsafe代码审查、构建体积检查及版本锁定，确保依赖安全可控。

.claude/skills/zeabur-dependencies/SKILL.md zeabur-oss/zeabur

Trigger Scenarios

修改Cargo.toml或Cargo.lock 修改web/package.json或web/bun.lock 引入新的Rust或前端第三方库

Install

npx skills add zeabur-oss/zeabur --skill zeabur-dependencies -g -y

More Options

Non-standard path

npx skills add https://github.com/zeabur-oss/zeabur/tree/main/.claude/skills/zeabur-dependencies -g -y

Use without installing

npx skills use zeabur-oss/zeabur@zeabur-dependencies

指定 Agent (Claude Code)

npx skills add zeabur-oss/zeabur --skill zeabur-dependencies -a claude-code -g -y

安装 repo 全部 skill

npx skills add zeabur-oss/zeabur --all -g -y

预览 repo 内 skill

npx skills add zeabur-oss/zeabur --list

SKILL.md

Frontmatter

{
    "name": "zeabur-dependencies",
    "description": "Add or upgrade a Rust or web dependency in Zeabur under its supply-chain policy (OSI licences, aws-lc-rs only, seven-day publish age, unsafe\/native review, bun.lock). Use whenever Cargo.toml, Cargo.lock, web\/package.json, web\/bun.lock or flake.nix changes."
}

Dependencies

Follow zeabur-oss-dependencies (install: npx skills add zeabur-oss/skills --skill zeabur-oss-dependencies; skills-lock.json pins it). This skill adds what is Zeabur's own.

Rust

The unsafe report is node_modules/.bin/zeabur-oss-unsafe-report zeabur zeaburctl zeabur-proxy zeabur-installer, run by scripts/ci/lint.sh. Only normal and build dependencies of zeabur, zeaburctl, zeabur-proxy and zeabur-installer count. kube's and axum's ws, for the terminal, brought in tungstenite when they moved from dev-dependencies to normal ones: that move needed the review.
k8s-openapi is built for Kubernetes 1.34 (v1_34), the oldest version Zeabur supports.

Web (`web/`)

Add packages from web/.
The one licence exception is caniuse-lite (CC-BY-4.0 data, pulled in by svgr's Babel, development only; see CONTRIBUTING.md).
Icons are Phosphor's, from @iconify-json/ph (built in by unplugin-icons with its JSX compiler, @svgr/core + @svgr/plugin-jsx; all dev dependencies). Components come from the shadcn registry (bunx --bun shadcn@latest add <component>), on Base UI.
@zeabur-oss/design-system comes from npm at an exact version, which Renovate moves.
Check the first-load size after adding a runtime package: ./scripts/build-ui.sh && ./scripts/ui-budget.sh.