Package.resolved should go in the .gitignore

It really doesn't make sense to ignore the Package.resolved file.

If you want reproducible builds, there needs to be a recorded copy of the exact versions that your project was using at a point in time. Without a Package.resolved, you don't have that.

For example, if you have from: "1.5.0" in your Package.swift, but are ignoring Package.resolved, this might have been built for your users with version 1.5.1, but if you checkout and rebuild, it may automatically resolve version 1.5.8 (and what you're building no longer matches what you shipped to your users).

It can be worse if you're working on a team: you could have developers with quite varied resolved dependency versions based on when they last updated their packages.

I'd recommend that you check the Package.resolved into your repository so that it is tagged alongside releases.

10 Likes