Two-click releases
Merge the Version packages pull request, approve the publish. Changesets and CI do the rest.
Lazy maintenance. Real security.
The standard behind Lupinum libraries: a seven-page handbook, repository starters, a read-only audit and a thin agent skill.
pnpm audit:repos lupinum-dev/<repository>
No tokens to steal
npm trusted publishing with provenance, from a protected environment, without installing anything.
Quarantined dependencies
New versions wait 24 hours and install scripts need an allowlist. Built into pnpm and Renovate.
Lean by rule
A check exists only if it guards user-facing behavior or a real attack path. The audit flags the rest.