Pin commits instead of branches

[mattmassicotte]

Feature Suggestion

Mandatory Information

Description
It is convenient, but problematic, to pin SPM packages to branches. Branches changes, which mean that builds are not repeatable. Both DavidFoundation and LaunchAtLogin are currently pointing to main.

It's less-convene it, but far safer, to put specific commits in there. This way, you guarantee that you have controlled what going is going into what version, and that updates are intentional instead of a side-effect of building.

Type
Non-UI

Mockups

Optional Information

Additional Information

Checklist

• I have filled out everything under Mandatory Information

[buresdv]

Oh, good eye! I never noticed they were pointing at a branch. Would it be okay to change them to "Up to Next Major Version", or do you think they should really be pointing to a specific commit?

[mattmassicotte]

I think Up to Next Major Version is the right choice if there actually is a release that will work. But, if you need something on a branch that hasn't been released, a specific commit is safest.

[buresdv]

Thanks for the tip, I'll fix it up