Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I don’t care how you do it, just make getting your dependencies deterministic based on files committed to your repo!

Happily the Tailwind hex package encourages you configure a fixed version number, so you’ll never get surprise breakage as long as you’re committing your mix.lock file as well.

I’m only suggesting package.json/package-lock.json because their projects are already using the npm ecosystem to fetch the tailwind dependency. A Makefile that does `curl $TAILWIND_GITHUB_RELEASE_URL -o ./departing/tailwind` is fine too (this is what Tailwind.hex is doing under the hood).



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: