---
title: "Make builds repeatable · Agent Wranglers"
url: https://agentwranglers.se/playbook/engineering/running-in-production/reproducible-builds
updated: 2026-10-20
licence: "All rights reserved"
---

# Make builds repeatable

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Running in production](https://agentwranglers.se/playbook/engineering/running-in-production)
- Rule: The same commit always gives the same build. Pin the language version, the tools and every dependency.
- How: Commit the lock file and install with it exactly, for example with `npm ci`, `composer install` or `uv sync --locked`. Pin the runtime in a file such as `.nvmrc` or `.python-version`, and pin container base images by digest. Where a tool writes the build time into its output, set `SOURCE_DATE_EPOCH` to the commit time. Build once and deploy that same artifact to test and production.
- Check: Build the same commit twice on different machines. The checksums of the output files match. The install fails when the lock file and the manifest disagree, as `npm ci` and `uv sync --locked` do.

Example:

```sh
export SOURCE_DATE_EPOCH=$(git log -1 --format=%ct)
npm ci && npm run build
find dist -type f -exec sha256sum {} + | sort -k2 > build.sha256
# Run the same on a second machine, then compare the two files
diff build.sha256 other-machine/build.sha256
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers engineering playbook: https://agentwranglers.se/playbook/engineering/running-in-production/reproducible-builds`.

- Next: [Keep settings outside the code](https://agentwranglers.se/playbook/engineering/running-in-production/settings-outside-the-code)
- [Running in production](https://agentwranglers.se/playbook/engineering/running-in-production)