Solutions

Checks that gate the merge, in JavaScript, C#, and Python.

Every language brings its own linter, its own audit command, and its own configuration, and none of them agree on what a finding looks like or which ones block a merge. The result is a wall of warnings that nobody owns and a gate that means something different in each repository.

Why it keeps happening

Findings that nobody can compare do not gate anything.

A vulnerability audit needs the dependencies installed, so it runs late and slowly, or not at all on the branch where it would matter. A lockfile that drifted from the registry's hashes passes it anyway, because nothing compares the two.

Each tool has its own severity scale, its own exceptions file, and its own exit codes. A team that ships JavaScript, C#, and Python maintains three gates that cannot be read side by side, and the rule that was relaxed in one is still strict in another.

Code-quality numbers exist and are ignored, because a number without a diagnosis and a threshold is a report, not a gate.

How we solve it

A checker per job, with a shared configuration and finding format.

The Dependably check tools are small command-line checkers, build-free by default, one per job, that read the same .dependably configuration and emit the same JSON finding format, so a rule, an exception, and a gate mean the same thing in every repository they run in.

Check the dependencies without installing them

npm-check validates, migrates, and repairs package-lock.json, verifies locked hashes against the registry's own, and scans locked versions for vulnerabilities, deprecations, and licence violations, with no node_modules and no npm audit subprocess. nucheck does the same for NuGet, matching four-part versions and interval ranges the way NuGet does, against the GitHub Advisory Database or OSV.

npm-check · nucheck

Lint without a build

cslint enforces every key in your .editorconfig, runs syntactic security checks that need no build step, loads the project through Roslyn for deeper analysis when asked, and scans for repository hygiene such as silently skipped tests. pycheck finds unused imports and validates committed packaging configuration.

cslint · pycheck

Measure and diagnose

codemetrics computes cyclomatic and cognitive complexity, Halstead volume, maintainability index, coupling, and cohesion for C# from one command, and turns them into diagnoses such as a god class or an unmaintainable hotspot, each with a severity you can gate on.

codemetrics

Gate the same way in each repository

Every tool discovers one .dependably file at the repository root, reads a common section and its own, applies the same rule and exception grammar, and emits findings in one JSON envelope. A gate configured once reads the same in CI for each of them.

.dependably · --format json
What you end up with

A gate you can read across repositories.

Findings from every language arrive in the same shape, with the same severity scale and the same exceptions, so what blocks a merge is a decision made once.

  • Dependency checks run on the branch, from the lockfile, before anything is installed.
  • A drifted or tampered lockfile is caught by comparing its hashes to the registry's.
  • Quality metrics come with a diagnosis and a threshold, so they can fail a job.
  • One configuration file per repository, shared by the checkers that run in it.
Finding
  • tool npm-check · vuln
  • package example-widget@2.4.1
  • severity high · gate: fail
  • config .dependably · common
Where it runs

Open source, installed from the registries you already use.

npm-check is on npm, and nucheck, cslint, and codemetrics are .NET tools on NuGet; pycheck is built from source. All are open source on GitHub under the Dependably organization, and they share one configuration contract and one finding schema.