Lix lockfiles versus haxelib manual pinning for environment reproducibility

Answer

For production‑grade reproducibility you should commit the haxe_libraries directory to version control. This guarantees bit‑identical artifacts without any network resolution or dependence on the lix version used at build time.

Confirmed facts

• Lix records exact library versions and content‑addressed hashes in its lockfile (lix.xml or lix.json). Running lix download on any machine with network access will fetch the same versions if the lix version, platform, and lockfile format are identical.
• Committing the generated haxe_libraries directory eliminates variability from lix updates, platform‑specific binary differences, and transient network failures, providing a fully hermetic build.
• Verification steps: after committing, check out the repo on a clean machine and run the build; no network calls or version changes should occur.

Likely explanation (conditional)

If you cannot or do not want to store the library directory (e.g., repository size concerns), relying on the lockfile can be sufficient provided that:

1. CI uses the exact same lix version that generated the lockfile.
2. All builders run on the same OS/architecture (or the lockfile does not contain platform‑specific selectors that would resolve different binaries).
3. Network access is reliable and the package registry remains unchanged.

When any of these conditions is uncertain, the lockfile alone may produce different artifacts, making the committed directory the safer choice.

Steps to decide

1. Generate or update the lockfile: lix install (or lix download if you already have a lockfile).
2. Record the lix version: lix --version.
3. Option A – Commit libraries: add the haxe_libraries folder to VCS and push.
4. Option B – Rely on lockfile: ensure CI runs lix download in a clean environment and compare the resulting haxe_libraries checksum with a known good snapshot.
5. If you choose Option B, verify that the CI lix version matches the one used to create the lockfile; otherwise fall back to Option A.

Missing diagnostic detail

To confirm whether the lockfile approach is safe for your pipeline, please specify: What lix version and operating system are used in your CI environment? If the answer differs from the versions used locally, committing haxe_libraries is recommended.