Should You Ignore go dep vendor/ in .gitignore?

The question of whether to add the go dep vendor/ folder to .gitignore arises when using Go's vendoring feature. Vendoring involves downloading dependencies into a local directory to ensure build consistency. While it can address compatibility issues, it also creates the dilemma of whether to track these dependencies in version control.

Advantages of Ignoring go dep vendor/

• Consistency: Ensures that every deploy will call dep ensure, ensuring consistent dependencies across team members.
• Avoids versioning issues: Keeps external dependency updates out of version control, preventing potential conflicts and version reference changes.

Disadvantages of Ignoring go dep vendor/

• Versioning control: If modifications are made to vendor dependencies, these changes won't be tracked in the repository.
• Dependency evolution: Vendoring tools can evolve, and ignoring the vendor/ directory may result in missing updates or incompatibilities.

Alternative Approaches

Beyond simply ignoring or including vendor/ in .gitignore, other approaches can address the underlying dilemma:

• Docker/Virtualization: Create a standardized development environment for all team members, eliminating the need for vendoring.
• Hybrid Approach: Keep vendor/ out of version control but provide scripts for generating it locally.
• Private Dependency Repository: Maintain a private repository for vendored dependencies, ensuring consistency without cluttering the main project repository.
• Go Modules: Embrace the current standard for dependency management in Go, potentially obviating the need for vendoring.

Ultimately, the best approach depends on the specific project and team requirements. Considering the advantages and disadvantages of ignoring go dep vendor/ and exploring alternative solutions can help find the optimal balance between dependency management and version control.