shared-monorepo-turborepo-cd524b — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited shared-monorepo-turborepo-cd524b (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Quick Guide: Turborepo 2.x for monorepo orchestration. Task pipelines with dependency ordering. Local + remote caching for massive speed gains. Workspaces for package linking. Syncpack for dependency version consistency. Internal packages use@repo/*naming, explicitexportsfields, andworkspace:*protocol.
<critical_requirements>
All code must follow project conventions in CLAUDE.md (kebab-case, named exports, import ordering, import type, named constants)(You MUST define task dependencies using `dependsOn: ["^build"]` in turbo.json to ensure topological ordering)
(You MUST declare all environment variables in the `env` array of turbo.json tasks for proper cache invalidation)
(You MUST set `cache: false` for tasks with side effects like dev servers and code generation)
*(You MUST use `workspace:` protocol for internal package dependencies)**
*(You MUST use `@repo/` naming convention for ALL internal packages)**
(You MUST define explicit `exports` field in package.json - never allow importing internal paths)
(You MUST mark React as `peerDependencies` NOT `dependencies` in component packages)
</critical_requirements>
Auto-detection: Turborepo configuration, turbo.json, monorepo setup, workspaces, Bun workspaces, syncpack, task pipelines, @repo/\* packages, package.json exports, workspace dependencies, shared configurations
When to use:
packages/When NOT to use:
Key patterns covered:
Detailed Resources:
<philosophy>
Turborepo is a high-performance build system designed for JavaScript/TypeScript monorepos. It provides intelligent task scheduling, caching, and remote cache sharing to dramatically reduce build times. Combined with workspaces, it enables efficient package management with automatic dependency linking.
</philosophy>
<patterns>
Define task dependencies and caching behavior in turbo.json to enable intelligent build orchestration and caching.
#### Key Concepts
dependsOn: ["^build"] - Run dependency tasks first (topological order)outputs - Define what files to cacheinputs - Specify which files trigger cache invalidationcache: false - Disable caching for tasks with side effectspersistent: true - Keep dev servers running#### Minimal Example
{
"tasks": {
"build": {
"dependsOn": ["^build"],
"env": ["DATABASE_URL", "NODE_ENV"],
"outputs": ["dist/**", ".next/**", "!.next/cache/**"]
},
"dev": { "cache": false, "persistent": true }
}
}Key: dependsOn: ["^build"] ensures topological execution, env declares variables for cache invalidation, cache: false for side-effect tasks.
See examples/core.md for full good/bad comparison examples.
Turborepo's caching system dramatically speeds up builds by reusing previous task outputs when inputs haven't changed.
#### What Gets Cached
dist/, .next/, framework-specific directories)cache: true)#### What Doesn't Get Cached
cache: false)cache: false - generates files)#### Cache Invalidation Triggers
env array).env, tsconfig.json)Setup: Link a Vercel account (or self-hosted cache), then set TURBO_TOKEN and TURBO_TEAM environment variables to enable remote cache sharing.
See examples/caching.md for remote caching configuration and CI integration examples.
Configure workspaces to enable package linking and dependency sharing across monorepo packages.
#### Key Concepts
package.json declares "workspaces": ["apps/*", "packages/*"]"@repo/ui": "workspace:*" protocol for automatic linkingapps/ for deployable apps, packages/ for shared codeSee examples/workspaces.md for full good/bad comparison examples and syncpack configuration.
</patterns>
<performance>
Cache Hit Metrics:
Optimization Strategies:
.env, tsconfig.json) to prevent unnecessary cache invalidation--filter=...[HEAD^]) to only run tasks for changed packages!.next/cache/**)Force Cache Bypass:
# Ignore cache when needed
bun run build --force
# Only build affected packages
bun run build --filter=...[HEAD^1]</performance>
<decision_framework>
New code? → Shared across 2+ apps? → packages/ (else keep in app)
Monorepo? → Builds > 30s or caching matters? → Use TurborepoFor comprehensive decision trees and package creation criteria, see reference.md.
</decision_framework>
<red_flags>
High Priority Issues:
dependsOn: ["^build"] for build tasks (breaks topological ordering)env array in turbo.json (causes cache misses across environments)exports field in package.json (allows internal path imports)Common Mistakes:
workspace:* for internal depsdependencies instead of peerDependencies--filter=...[HEAD^] affected detectionGotchas:
dependsOn: ["^task"] runs dependencies' tasks; dependsOn: ["task"] runs same package's task--filter=...[HEAD^] requires fetch-depth: 2 in GitHub Actions!.next/cache/**For detailed anti-patterns and checklists, see reference.md.
</red_flags>
<critical_reminders>
All code must follow project conventions in CLAUDE.md
(You MUST define task dependencies using `dependsOn: ["^build"]` in turbo.json to ensure topological ordering)
(You MUST declare all environment variables in the `env` array of turbo.json tasks for proper cache invalidation)
(You MUST set `cache: false` for tasks with side effects like dev servers and code generation)
*(You MUST use `workspace:` protocol for internal package dependencies)**
*(You MUST use `@repo/` naming convention for ALL internal packages)**
(You MUST define explicit `exports` field in package.json - never allow importing internal paths)
(You MUST mark React as `peerDependencies` NOT `dependencies` in component packages)
Failure to follow these rules will cause incorrect builds, cache misses, broken dependency resolution, and tree-shaking failures.
</critical_reminders>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.