Add vendoring policy to AGENTS.md
ober
2d5b4bb107260e0a24f2e314e6d5954667ed106b
--- a/AGENTS.md +++ b/AGENTS.md @@ -348,6 +348,23 @@ Common sibling repos that exist but must NOT be touched without explicit instruc If a user instruction mentions a file path, use EXACTLY that path. Do not substitute a similar-looking path from another repo. +### Never Reference Sibling Checkouts in Build Files + +Build files (Makefile, shell scripts, CI config) must **never** resolve a +dependency via a relative sibling path (`../jerboa-foo`) or an absolute +`~/mine/jerboa-foo` path. That layout is specific to this one machine — +other users and CI do not have it. Always vendor instead: fetch/clone the +dependency into `vendor/` (or this repo's equivalent) at build time, or use +a pinned-release fetch script, so the build is reproducible without +assuming any sibling checkout exists. + +A sibling-path fallback is not just a portability bug: it can silently +substitute a full alternate source tree (build config, embedded data, +secrets) for the vendored one, with no equivalent safety default, changing +what actually gets built without any indication. If you find one +(`grep -rn '\.\./jerboa\|~/mine/jerboa'` over Makefiles/scripts), remove it +and vendor properly instead. + --- ## Build & Verification