前端工程化实践：依赖治理策略与自动化工作流落地指南

alias pi="pnpm install"
alias pa="pnpm add"
alias pad="pnpm add -D"
alias prm="pnpm remove"
alias px="pnpm dlx"

{
  "scripts": {
    "preinstall": "npx only-allow pnpm"
  }
}

pnpm add -D knip
pnpm knip

{
  "$schema": "https://unpkg.com/knip@5/overview/config.json",
  "entry": ["src/main.ts", "vite.config.ts"],
  "project": ["src/**/*.{ts,tsx}"],
  "ignoreDependencies": ["@types/*"]
}

{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:base",
    ":semanticCommitTypeAll(chore)"
  ],
  "timezone": "Asia/Shanghai",
  "schedule": ["before 9am on Monday"],
  "packageRules": [
    {
      "description": "Lint 相关的包合并成一个 PR",
      "matchPackagePatterns": ["eslint", "prettier", "stylelint"],
      "groupName": "lint-tools"
    },
    {
      "description": "DevDependencies 的次版本/补丁版本自动合并",
      "matchDepTypes": ["devDependencies"],
      "matchUpdateTypes": ["minor", "patch"],
      "automerge": true
    }
  ]
}

name: Dependency CI

on:
  pull_request:
    paths:
      - 'package.json'
      - 'pnpm-lock.yaml'

jobs:
  audit-and-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install pnpm
        uses: pnpm/action-setup@v3
        with:
          version: 8

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # 1. 安全漏洞巡检（只拦截高危以上）
      - name: Security audit
        run: pnpm audit --audit-level high

      # 2. 检查死代码与冗余依赖
      - name: Run Knip
        run: pnpm dlx knip --no-exit-code