projects are not locked to their commit hash

[milahu]

🐛 Bug Report

readme claims that metarepos are reproducible

give every engineer on your team the same project setup, regardless of where it's cloned

but the git urls in .meta are missing the commit hash
so when upstream changes, a new clone is different

Expected behavior

git urls should have the commit hash as url fragment id

{
  "projects": {
    "repos/meta": "https://github.com/mateodelnorte/meta#1b727d56b7f09d3f27788ac02346f184622d36de"
  }
}

git stores ...
the path + url in .gitmodules
the commit in .git/modules/repos/meta/refs/heads/master
the branch in .git/modules/repos/meta/config

[mateodelnorte]

No. The point of the tool is ensuring that users can get up to date via ‘meta git pull origin main’. You would not store the git hash for the same reason you wouldn’t checkout a single git repo by its git hash.

…

On Sat, Nov 26, 2022 at 1:14 PM milahu ***@***.***> wrote: 🐛 Bug Report readme claims that metarepos are reproducible give every engineer on your team the same project setup, regardless of where it's cloned but the git urls in .meta are missing the commit hash so when upstream changes, a new clone is different Expected behavior git urls should have the commit hash as url fragment id { "projects": { "repos/meta": "https://github.com/mateodelnorte/meta#1b727d56b7f09d3f27788ac02346f184622d36de" } } git stores ... the path + url in .gitmodules the commit in .git/modules/repos/meta/refs/heads/master the branch in .git/modules/repos/meta/config — Reply to this email directly, view it on GitHub <#310>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAEHOX2NSVLCUIRBRVSKNILWKJOPFANCNFSM6AAAAAASMECYWU> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[milahu]

you wouldn’t checkout a single git repo by its git hash

but thats what i want ...

"reproducible build" means locking sources to exact versions

[mateodelnorte]

I think you misunderstand the purpose of this tool. meta is not intended to be used in build processes. It is intended to be used in development processes. If you are building a graph of software using meta, you are using it wrong.

meta exists to allow teams of engineers to reproduceably install and track development of many repositories of software, together.

If you want to build packages together, you may want something like lerna. And you can easily have lerna packages as child repos within your meta repos.