I'm finally trying to get on board with using Drupal 8 and want to know if I should ignore the vendor directory in git with .gitignore. I would assume not, but I've seen a few example .gitignore files that do.


4 Answers 4


There isn't really a right or wrong answer, it will come down to your situation. Composer themselves have pretty strong feelings that yes, you should ignore it, and in an ideal world that's definitely what you should do, but it's not always that straightforward.

It depends mainly on your hosting and deployment process. If, for example, you're on Pantheon, and don't wish to implement a complicated upstream workflow, involving a dialogue with their technical staff, you're forced to commit all dependencies to the repo. There's no Composer sitting at the other end waiting to run when your code is pushed, if you don't push those files up yourself, they're not there, and things will break.

Similarly if you're on shared hosting and don't have a CI workflow, you're probably going to be forced into lugging all the files around with you in one way or another.

Basically if it fits into your development/deployment workflow to be able to exclude those files, it's a good idea to (for the reasons listed in the link above).

If it doesn't, committing them to the repo is absolutely fine.

  • 2
    Reference: Pantheon workflow for Composer using GitHub: pantheon.io/docs/guides/build-tools. vendor is ignored on the GitHub repository, but must be committed when built artifact is pushed up to Pantheon. Oct 26, 2017 at 21:36
  • Along these same lines, this blog post IMO has a sound argument against ignoring vendor from git: codeenigma.com/build/blog/…
    – rooby
    Sep 27, 2018 at 8:51
  • @clive Can I install open social distribution on pantheon keeping vendor folder outside root? In pantheon's case, its named "code"
    – Umair
    May 31, 2019 at 18:58

Drupal core and modules update so frequently, often with security fixes, that it has become common to use composer to manage dependencies. Composer will place dependencies in the vendor directory, and then you don't need to commit them to your codebase. You can run "composer install" on the server and it will download the dependencies on that server. This allows your code repository to be lighter. If you are using this process, you wouldn't want to commit the files, so yes, you'd want to gitignore that directory.

If you want to get up and running with using composer to manage a drupal site, you can check out the drupal scaffold project.


Yes you should

If you have composer you can include it with composer.

If you don't know how to use composer this would be a great place to look:

Using composer to manage drupal site dependencies

  • 1
    I have pasted a link if you need me to give a code example just ask ;)
    – user72672
    Oct 26, 2017 at 20:37

I would say no. The composer.json file has version requirements and composer.lock specifies the exact versions that are installed. Having the composer.lock in version control effectively defines what is in the vendor directory and its history, therefore it is not necessary to have any history of the vendor directory itself.

Secondly, vendor directories tend to be HUGE, many times that of your own project so if you want to keep your repository lean, then don't commit the vendor directory.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.