pl_vendor

pl_vendor copies Git repositories into another repository as ordinary files and records their exact commits in a deterministic YAML lockfile. It supports optional downstream patches and can verify that checked-in vendor trees still match their locked upstream commits.

Requirements

• Python 3.13 or newer
• Git 2.30 or newer
• uv 0.9 or newer by default

The package has no Python runtime dependencies.

Every command runs a preflight check before reading or changing vendored trees. Library callers that use another environment runner can pass an ExecutableBackend to VendorProject.discover(); that executable and its declared minimum version are checked in place of uv. Git is always checked.

Configuration

Create vendor.toml at the root of the consuming Git repository:

schema_version = 1

[dependencies.example]
path = "vendor/example"
url = "https://github.com/example/example.git"
branch = "release"

The generated vendor-lock.yaml records the resolved commit:

lockfileVersion: 1

dependencies:
  example: '0123456789abcdef0123456789abcdef01234567'

Optional patches live at .vendor-patches/<dependency-name>.patch and are applied after copying the upstream tree.

Commands

pl-vendor update
pl-vendor update example
pl-vendor check
pl-vendor verify

Each command discovers the consuming repository from the current directory. Pass --root PATH after the command to operate on a different repository.

Development

uv sync --dev
uv run pytest
uv run pyright
uv run ruff format --check .

The internal test suite is kept in src/pl_vendor/tests so the package remains self-contained while it is developed or embedded elsewhere.