Reference
FAQ
Scope, limits, and where lockstep fits next to the toolchain tools you already use.
Questions
Does it need a browser or a network?
No. lockstep reads local files only, with no network code, uploads, or telemetry. It runs the same on a laptop, in a container, or in air-gapped CI.
Does it change my project?
No. lockstep is read-only. It never rewrites package.json, a version file, or a workflow. The only file it writes is the SARIF report when you pass --sarif.
How many projects can I audit at once?
One per run. Pass a positional directory or --dir <path>; the default is the current directory. Passing more than one path is a usage error that exits 2.
What happens when a file is missing?
A missing source is skipped, not an error. Most projects do not have all of .nvmrc, .node-version, .tool-versions, and mise.toml, and that is expected.
Does it check my dependencies?
No. lockstep is not a security scanner and does not inspect the dependency tree. It compares the versions of Node, Bun, and the package manager declared across the project.
How do I fail CI on warnings too?
Run lockstep --fail-on warning. It affects only the exit code; every finding is still reported and included in JSON and SARIF output.
What do the exit codes mean?
0 when there are no findings at or above --fail-on, 1 when there are, 2 on invalid usage or unreadable input, and 3 on an I/O error writing the report.
Limitations
Static analysis
lockstep reads declarations; it does not run your toolchain or install anything. It checks the places a version is declared, so a version injected at runtime, matrix-expanded in a workflow, or resolved from a remote config is outside its view. It covers GitHub Actions workflows only, not other CI providers.
How it compares
packageManager, but does not compare that field to engines, the lockfile, or CI, and it is being removed from Node. nodejs.orgpackage.json files in a monorepo. It does not look at Node, Bun, or package-manager versions. github.com/JamieMason/syncpackengines, .nvmrc, the lockfile, and CI all name the same runtime. docs.renovatebot.com