feat(checks): flag a lockfile change with no manifest change

[bkd-dotcom]

Closes #16.

What I found on the way in

The gate this issue feeds was dead. supply.dependency_skew is referenced in three places — the gate report (__init__.py), the verdict logic (verdict.py), and the rendered comment (render.py) — but no scanner ever produced it.

So every review comment this project has ever posted printed:

| Dependency skew | ✅ ok |

…from a check that did not exist. This issue is that check.

The check

scan_dependency_skew flags a lockfile that moved without its sibling manifest:

ecosystem	lockfile	manifest
npm / yarn / pnpm / bun	package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, bun.lockb	package.json
Python	uv.lock, poetry.lock / Pipfile.lock	pyproject.toml / Pipfile
Rust	Cargo.lock	Cargo.toml
Go	go.sum	go.mod
PHP	composer.lock	composer.json
Ruby	Gemfile.lock	Gemfile

Matching is per-directory, so a monorepo's packages/a/package-lock.json is not satisfied by packages/b/package.json. Comparison is case-insensitive (Cargo.lock, Gemfile.lock, Pipfile.lock).

Advisory, not blocking — and why that needed a second fix

Resolved versions moving with no declared intent is the shape of a dependency-substitution attack. It's also exactly what npm audit fix, cargo update and Dependabot do, legitimately, all the time.

The old gate wiring ignored the blocking flag:

dep_ok = not any(f.id == "supply.dependency_skew" for f in findings)

unlike secret_scan_clean and no_forbidden_perm_change, which both key off blocking. Because a failed gate produces verdict=BLOCK / "not mergeable until resolved", emitting this finding under the old wiring would have hard-blocked every Dependabot PR. Fixed to match the other two gates.

The safety property survives without blocking

I checked rather than assumed. auto_merge_eligible requires worst.rank <= LOW, and this finding is MEDIUM:

change	verdict	worst	auto-merge (opted in)
lockfile only	safe	medium	False ✅
lockfile + manifest	safe	info	True

So a lockfile-substitution PR is surfaced and withheld from auto-merge, without rejecting honest refreshes. Both directions are pinned by test_dependency_skew_withholds_auto_merge.

Verification

29 tests pass (23 existing + 6 new), ruff clean. Confirmed the finding renders in the comment as a 🟡 advisory item alongside a ✅ gate row.

New tests: all ten lockfile/manifest pairs · the paired case · advisory (non-BLOCK) behaviour · per-directory monorepo matching · a non-lockfile control · the auto-merge invariant.

Note

If you'd rather this escalate to NEEDS_HUMAN instead of SAFE-with-no-auto-merge, that's a one-line change in verdict.py — I went with the less intrusive option since the auto-merge bar already withholds authority.