Agent Skills › zeabur-oss/zeabur › zeabur-dependencies

zeabur-dependencies

GitHub

规范 Zeabur 项目中 Rust 和 Web 依赖的添加与升级，确保符合供应链政策（许可证、版本、安全性），并检查构建产物大小。

.claude/skills/zeabur-dependencies/SKILL.md zeabur-oss/zeabur

Trigger Scenarios

修改 Cargo.toml 或 web/package.json 需要添加新的第三方依赖

Install

npx skills add zeabur-oss/zeabur --skill zeabur-dependencies -g -y

More Options

Non-standard path

npx skills add https://github.com/zeabur-oss/zeabur/tree/main/.claude/skills/zeabur-dependencies -g -y

Use without installing

npx skills use zeabur-oss/zeabur@zeabur-dependencies

指定 Agent (Claude Code)

npx skills add zeabur-oss/zeabur --skill zeabur-dependencies -a claude-code -g -y

安装 repo 全部 skill

npx skills add zeabur-oss/zeabur --all -g -y

预览 repo 内 skill

npx skills add zeabur-oss/zeabur --list

SKILL.md

Frontmatter

{
    "name": "zeabur-dependencies",
    "description": "Add or upgrade a Rust or web dependency in Zeabur under its supply-chain policy (OSI licences, aws-lc-rs only, seven-day publish age, unsafe\/native review, bun.lock). Use whenever Cargo.toml, Cargo.lock, web\/package.json, web\/bun.lock or flake.nix changes."
}

Dependencies

Follow zeabur-oss-dependencies (install: npx skills add zeabur-oss/skills --skill zeabur-oss-dependencies; skills-lock.json pins it). This skill adds what is Zeabur's own.

Rust

The unsafe report is ./scripts/ci.sh unsafe-report. Only normal and build dependencies of zeabur, zeaburctl, zeabur-proxy and zeabur-installer count. kube's and axum's ws, for the terminal, brought in tungstenite when they moved from dev-dependencies to normal ones: that move needed the review.
k8s-openapi is built for Kubernetes 1.34 (v1_34), the oldest version Zeabur supports.

Web (`web/`)

Add packages from web/.
The one licence exception is caniuse-lite (CC-BY-4.0 data, pulled in by svgr's Babel, development only; see CONTRIBUTING.md).
Icons are Phosphor's, from @iconify-json/ph (built in by unplugin-icons with its JSX compiler, @svgr/core + @svgr/plugin-jsx; all dev dependencies). Components come from the shadcn registry (bunx --bun shadcn@latest add <component>), on Base UI.
@zeabur-oss/design-system comes from npm at an exact version, which Renovate moves.
Check the first-load size after adding a runtime package: ./scripts/build-ui.sh && ./scripts/ui-budget.sh.