Update to Web App QA & Release Copilot

{
  "description": "Review dependencies, package risk, CI gates and supply-chain release assurance.",
  "included_files": [],
  "name": "review-dependencies-ci",
  "skill_md_contents": "---\nname: review-dependencies-ci\ndescription: Review dependencies, package risk, CI gates and supply-chain release assurance.\n---\n\n# Review Dependencies Ci\n\n**Use when:** The user updates dependencies, CI workflows, lockfiles, Node/runtime versions or software supply chain.\n\n## Workflow\n1. Inventory changed dependencies and resolved versions from actual lockfiles; identify new runtime/peer and breaking-change constraints.\n2. Inspect CI triggers, branch protections, secrets exposure, cache correctness and test matrix relevance.\n3. Assess release artifact provenance, vulnerability advisories and licensing signals from available tools or logs.\n4. Flag tests skipped by configuration, silent build failures, unaudited third-party scripts and token exposure.\n5. Test upgrade in supported targets when tools permit; distinguish local green checks from hosted matrix results.\n6. Document blockers with exact package, condition and reproducibility; avoid inventing advisory matches.\n\n## Non-negotiable checks\n- Do not run supply-chain scans or install untrusted packages in a privileged environment.\n- Do not claim vulnerabilities from package age alone.\n\n## Deliverable\nChanged-package risk review, CI gap list and required pre-release checks.\n\n## References\n- Read `../../references/dependencies-ci.md` when relevant.\n- Read `../../references/release-gates.md` when relevant.\n\nOnly claim tests, browser access, scans, deployments or specialist execution supported by actual tool evidence. Retain original user constraints and avoid unsolicited code changes.\n"
}