Non core third party modules are maintained in modules directory in the Drupal root directory. Should this directory be added to the .gitignore file?

If a module is upgraded in a Staging system then why would the module be managed in a site specific Git repository when no changes are intended and the module is maintained by a third party? Surely if the module is required in production then it is a case of simply installing the module once pulling is finished?

If composer is used, would it be sufficient to run composer update once code is pulled (including composer.json) to have any missing modules installed? I am assuming that this would ensure staging and production modules are kept synchronized without maintaining code in Git.

  • Closing as dupe of the more canonical question as there's no difference between the vendor and modules/contrib folder in this context
    – Clive
    Commented Mar 10, 2022 at 10:26

1 Answer 1


This is totally up to you and how you want to manage your web server.

For example, among dedicated Drupal hosts, Platform.sh and Pantheon have you commit composer.json and composer.lock, and then they automatically build your site based on that. This has the benefit of keeping your git repo small.

But, if you have a simple site on shared hosting, it is sometimes easier to commit all the modules so that you can do git checkout and be done without worrying about build failures. Of course, this makes the repository much bigger.

In the end, I don't think there is a Drupal best practice about this because it is a question of build tools. However, composer states that their best practice is to not commit dependencies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.