use lock file

etc/build.py

@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 import argparse
 import hashlib
+import json
 import os
 import re
 import shutil
@@ -52,11 +53,21 @@ def read_plugin_tuple(repo):
             yield m.groups()
 
 
+def read_plugin_lock_db(repo):
+    lock_file = repo.joinpath('vim', 'plugins.lock.json')
+    return json.loads(open(lock_file, "rt").read())
+
+
 def clone_vim_plugins(repo):
     bundle_dir = repo.joinpath('vim', 'bundle')
+    db = read_plugin_lock_db(repo)
     for (name, url) in read_plugin_tuple(repo):
         print(f'Cloning {name}')
-        subprocess.run(['git', 'clone', '--quiet', url, name], cwd=bundle_dir)
+        subprocess.run(['git', 'clone', '--quiet', url, name], check=True, cwd=bundle_dir)
+        commit_id = db[name]
+        print(f'Resetting {name} to locked commit {commit_id}')
+        plugin_dir = bundle_dir.joinpath(name)
+        subprocess.run(['git', 'reset', '--hard', commit_id], check=True, cwd=plugin_dir)
 
 
 # Generate files that need information from git

vim/generate-plugin-lock.py

@@ -0,0 +1,31 @@
+#!/usr/bin/env python3
+
+import re
+import subprocess
+import json
+from pathlib import PurePath
+
+def read_plugin_tuple():
+    pattern = re.compile(r'^(\w\S+)\s+(\S+)')
+    plugin_file = open('plugins', 'rt')
+    for line in plugin_file.readlines():
+        m = pattern.match(line)
+        if m:
+            yield m.groups()
+
+def main():
+    lock_db = {}
+    for name, url in read_plugin_tuple():
+        cwd=PurePath("bundle").joinpath(name)
+        process = subprocess.run(['git', 'rev-parse', 'HEAD'], check=True, cwd=cwd, capture_output=True)
+        output = process.stdout.decode().strip()
+        lock_db[name] = output
+    db=json.dumps(lock_db, sort_keys=True, indent=4)
+    with open('plugins.lock.json', 'wt') as f:
+        f.write(db)
+    print(db)
+
+
+if __name__ == '__main__':
+    main()
+