Pin your versions

“It works on my machine” has a close relative: “it worked last month.” The usual cause is a tool that updated itself.

The rule

Every tool your build uses should have an exact version written down in the repository: the static site generator, the link checker, the linter, the container base image, even the image your CI jobs run in.

Pin by content, not by name

A version number can be re-published. A checksum cannot. For downloads, store the expected checksum next to the version and verify it before running anything. For container images, pin the digest, not only the tag.

tool-version  = 1.2.3
tool-checksum = the hash published for that exact file

Upgrade on purpose

Pinned does not mean frozen. It means upgrades happen when you decide, in a commit you can review and revert. Change one version, run the checks, push. If something breaks, the diff tells you why.

The one exception

Sometimes the upstream project publishes no checksum. Then the first download is a leap of faith. Record the hash you got and say so in a comment, so the next person knows how much to trust it.