3 ms·
That's a fair point. I think for many projects which only consume dependencies the answer can be "yes, just commit all your dependencies" in many instances. Pul
by formerly_proven 5y ago
That's a fair point. I think for many projects which only consume dependencies the answer can be "yes, just commit all your dependencies" in many instances. Pulling from internal repos shouldn't be critical though as long as the read-only tokens you're using can only access what the developers can read anyway; pulling "unintended" code in a CI should never be able to escalate because we're running anything a dev pushed.
- NAHWheatCracker 5y agoI've heard of doing this, although not worked on such a project. Committing node_modules seems wild to me and I foresee issues with committing all the Python wheels necessary for different platforms on some projects. I'm a proponent of lock-file approaches, which gain 99% of the benefits with far less pain. It requires network access, though.
- emteycz 5y agoYarn v2 is much better for committing dependencies than committing node_modules. However, it's problematic. Only use it if you're certain it will solve a specific problem you have. Consider using Docker to build images that include a snapshot of node_modules.