Vendoring - CI/CD Glossary Definition

Vendoring is committing your dependencies source code directly into your repository (often a vendor/ directory) so builds need no network fetch and the exact code is version-controlled.

Where it is common

Go popularized go mod vendor, which writes all module sources into vendor/. Builds then run fully offline and reproducibly, which is valuable in air-gapped or audit-heavy CI.

Trade-offs

Vendoring bloats the repo and diffs, but it eliminates registry outages and dependency-confusion risk because nothing is resolved at build time.

Related guides