Best approach for more secure work environment?

[benfrain]

I'm trying to move to a more security conscious setup for handling plugins at work; at present I run a :Lazy update whenever I fancy getting the latest version of a plugin.

My thinking was I would commit my personal (home) .local/share/nvim/lazy folder to a Git repo, and get our security team to download and check the contents of that repo to ensure they are happy. Then I could git clone that repo into my work .local/share/nvim/lazy folder. My personal config files (.config/nvim/) would be fine to be outside the repo.

Is that likely to work? Any problems with that approach? Only thing I could do with is some way of disabling the update functionality of Lazy so I don't inadvertently pull some 'unchecked' code into my environment. Is there a way to do that with the Lazy config?

[folke]

That wouldn't work. You can better checkout those plugins in a separate folder on your work station. So not the directory that lazy manages.

Configure that folder as your config.dev.path.

Set config.dev.patterns = {""} (it must be empty, so it will match every plugin)

That way everything should work and lazy will never try to update or make changes to those folders

[benfrain]

Lovely, thanks for taking the time. I'll give that a whirl.