I don't think you need to go quite so far as checking gigabytes of executables into version control. If you download some dependencies at build time, that's fi

I don't think you need to go quite so far as checking gigabytes of executables into version control. If you download some dependencies at build time, that's fine as long as you know exactly what they are ahead of time. "Exactly what they are" means a hash, not a name and version tag. The dockerized build approach is actually a good strategy, unfortunately it's done by image name instead of image hash in practice. Upgrading dependencies, or otherwise resolving a name and version to a hash is a pre-source task, not a from-source task. Maybe it can be automated, and a bot can generate pull requests to bump the versions, but that happens as a proposed change to the source, not in a from-source task like build, test, publish, or deploy.