360 Secure SkillHub
360 安全技能中心

Monorepo Dependency Checker

通过 shell 命令识别工作区工具并列出各包,构建内部依赖图,检测循环依赖、版本冲突、无谓耦合与包边界违规,输出含依赖图、问题清单、包健康度和架构建议的 Markdown 报告。命令需自行在仓库根目录执行,未附带解析脚本或自动修复。

charlie-morrison
charlie-morrison
热度 27.47
最近更新 2026-05-10 17:59:32
分类:开发依赖:代码执行 / 读写文件应用场景:代码审查 / DevOps / 报告撰写 / 工作流

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add monorepo-dependency-checker
Metadata
name
monorepo-dependency-checker
description
Analyze monorepo dependency graphs for version conflicts, circular imports, unnecessary coupling, and optimal package boundaries using Nx, Turborepo, Lerna, or pnpm workspaces.
metadata
{"tags":["monorepo","dependencies","nx","turborepo","architecture"]}

Monorepo Dependency Checker

Analyze monorepo dependency graphs for version conflicts, circular imports, unnecessary coupling, and package boundary violations. Works with Nx, Turborepo, Lerna, pnpm workspaces, and npm workspaces.

Usage

"Check my monorepo for dependency issues"
"Find circular dependencies between packages"
"Audit version consistency across workspaces"
"Analyze package boundaries in my monorepo"

How It Works

1. Workspace Discovery

# Detect monorepo tool
cat nx.json 2>/dev/null && echo "Nx workspace"
cat turbo.json 2>/dev/null && echo "Turborepo"
cat lerna.json 2>/dev/null && echo "Lerna"
cat pnpm-workspace.yaml 2>/dev/null && echo "pnpm workspace"

# List all packages
find . -name "package.json" -not -path "*/node_modules/*" -maxdepth 3

2. Dependency Graph

Build the internal dependency graph:

  • Which packages depend on which
  • Direct vs transitive dependencies
  • Shared dependencies across packages
  • External dependency versions

3. Issue Detection

Circular dependencies:

  • Package A → B → C → A (cycle)
  • Impact: build ordering issues, bundle size, testing complexity
  • Fix: extract shared code into new package or restructure

Version conflicts:

  • Different versions of same external dep across packages
  • Peer dependency mismatches
  • Lockfile inconsistencies

Unnecessary coupling:

  • Packages importing from other packages' internals
  • Shared state between packages that should be independent
  • Test utilities leaking into production bundles

Boundary violations:

  • UI packages importing from backend packages
  • Feature packages depending on other features (should go through shared)
  • Missing package.json exports field

4. Architecture Recommendations

  • Layered architecture: shared → domain → feature → app
  • Proper barrel exports (index.ts) in each package
  • Build order optimization
  • Affected/changed package detection for CI
  • Package extraction candidates (frequently co-changed files)

Output

## Monorepo Dependency Analysis

**Tool:** Turborepo | **Packages:** 12 | **Workspace:** pnpm

### Dependency Graph

app-web → ui, api-client, config, types app-mobile → ui, api-client, config, types api-server → database, config, types, utils ui → types, config api-client → types database → types, config


### 🔴 Circular Dependencies (1)
- utils → database → utils
  utils/logger imports database/connection for query logging
  → Extract logging config to `config` package

### 🟡 Version Conflicts (3)
| Package | Versions | Location |
|---------|----------|----------|
| react | 18.2, 18.3 | app-web vs ui |
| zod | 3.22, 3.23 | api-server vs types |
| typescript | 5.3, 5.4, 5.5 | various |

### 📊 Package Health
| Package | Internal Deps | External Deps | Build Order | Issues |
|---------|--------------|---------------|-------------|--------|
| types | 0 | 1 | 1 | ✅ |
| config | 1 | 3 | 2 | ✅ |
| utils | 2 | 5 | 3 | 🔴 circular |
| ui | 2 | 12 | 4 | 🟡 version |
| database | 2 | 4 | 3 | 🔴 circular |

### ✅ Good Practices
- Clean layered architecture (types → config → domain → app)
- Proper exports field in all package.json files
- Shared tsconfig.base.json with package-level extends
- Turborepo pipeline configured for incremental builds