Module Dependency Lock File

The lock file (invkmod.lock.cue) records the exact versions of all resolved module dependencies, ensuring reproducible builds across machines and over time.

It is auto-generated by invowk module sync and invowk module update.

Example Lock File

version: "1.0"
generated: "2025-01-10T12:34:56Z"

modules: {
    "https://github.com/example/common.invkmod.git": {
        git_url:          "https://github.com/example/common.invkmod.git"
        version:          "^1.0.0"
        resolved_version: "1.2.3"
        git_commit:       "abc123def4567890"
        alias:            "common"
        namespace:        "common"
    }
}

Root Fields

Field	Description
version	Lock file format version
generated	Timestamp when the lock file was created
modules	Map of module keys to locked module entries

Module Entry Fields

Each entry in modules contains:

Field	Description
git_url	Git repository URL
version	Original version constraint from invkmod.cue
resolved_version	Exact resolved version
git_commit	Commit SHA for the resolved version
alias	Namespace alias (if set)
path	Subdirectory path (if set)
namespace	Computed namespace for commands

Module Keys

The key in the modules map is derived from the Git URL and optional path:

modules: {
    "https://github.com/example/monorepo.invkmod.git#modules/cli": {
        git_url: "https://github.com/example/monorepo.invkmod.git"
        path:    "modules/cli"
    }
}

Usage Notes

• Commit invkmod.lock.cue to version control for reproducible builds.
• invowk module add does not write the lock file; use invowk module sync.

Common Workflows

# Resolve and lock
invowk module sync

# Commit the lock file
git add invkmod.lock.cue
git commit -m "Lock module dependencies"