Hugo Module Dependency Pinning Across Rebuilds

Hugo modules resolve external themes and components from Git repositories declared in the site configuration, using tags or branches at build time. The goal is to ensure that local and CI builds resolve an identical module revision without manual configuration drift.

Hugo does not provide a native lock file or checksum pinning mechanism for module dependencies. Authentication for private repositories depends on the environment's Git credential helpers, and changing a module tag requires manual edits followed by a full rebuild. It remains unresolved whether Hugo will introduce lock-file support or whether revision pinning must be handled outside the generator.

Does Hugo plan to add a native module lock file that enforces exact revision resolution across builds? Can module versions be pinned to immutable commits instead of mutable tags or branches? What mechanism should teams use to reconcile module revisions between local development and CI?