Pinning your toolchain: a short checklist

October 2026

A new teammate clones the repository, runs the build and gets a different result than everyone else. Nine times out of ten the cause is an unpinned tool somewhere in the chain.

What to pin

• The language runtime (a .tool-versions or similar file in the repository root).
• The package manager and its lockfile, committed and reviewed like any other code.
• Base images in container builds: prefer a fixed tag or digest over latest.
• Linters and formatters, so that CI and editors agree on what clean code means.

How to keep it honest

Add a single command that prints every pinned version and run it at the start of CI jobs. When something drifts, the log shows it immediately, long before anyone starts guessing.