feature request: have an option to create vendor tarballs with locked versions

[jubalh]

It would be useful to have an option to create vendor tarballs with locked versions, so that in such cases we don't have to create the tarball ourselves. For context: https://github.com/ast-grep/ast-grep/issues/1118

[uncomfyhalomacro]

oh you mean to respect the existing lockfile @jubalh ? I remember there was a lockfile parameter with value bool. maybe you want that added back?

[jubalh]

Probably yes :) I also chatted with @msirringhaus about this before opening the issue.

Was there a reason to remove this feature if it already existed?

[uncomfyhalomacro]

if i can remember correctly, i feel like i removed it because to respect the lockfile, one might just set the update parameter to false. and honestly, in offline mode, it looks for the lockfile at the root of the project so setting update to false will just fallback to the old lockfile. i assume you tried setting update to false? @jubalh

[uncomfyhalomacro]

secondly, i think it's the prerogative of the upstream developers to set the versions or something and it's also up to us to do "what we feel" what's right.

hmm i also found out new flags for update in this discussion which might be a good addition to enable fine-grained control for update parameter

[uncomfyhalomacro]

AH i added an explainer as well. https://github.com/uncomfyhalomacro/obs-service-cargo?tab=readme-ov-file#about-lockfiles

this means if update is set to true, we regenerate the lockfiles (well part of the update process does that already), and replace the old ones

[uncomfyhalomacro]

@jubalh pls test the changes! thank you. i wont create a tagged release yet until you confirm