3 ms·
I've seen teams take this even further and vendor all dependencies. This way a commit hash contains even the exact third party code involved.
by hu3 2y ago
I've seen teams take this even further and vendor all dependencies.
This way a commit hash contains even the exact third party code involved.
- yurishimo 2y agoThis is perfectly fine if your language of choice doesn’t have a robust package manager that supports version pinning. But then you need to enforce pinning across your org which could prove its own challenge.
- hu3 2y agoWhy only restrict to these cases? One of the teams vendored npm and go packages which are robust. Code always ran inside Docker. Being able to just clone and run simplified their flow.