Shall the lockfile be checked in to VCS?

[tisonkun]

For libraries, for applications, for action scripts e.g. running in GitHub Actions.

I wonder if it's a good practice to check in the lockfile to VCS or it's necessary.

cc @frostming

[pawamoy]

Usually, applications projects track their lockfile (end-user apps, never used as libraries). I know some library projects that track their lockfile too. There are some pros and cons. I myself do not track lockfiles for my libraries: I prefer letting CI break early so I can fix any issue gradually.

[tisonkun]

Make sense.