[feature request] RO dependencies, or check for dirty for dependencies

[sigmuha]

For new users of bender, not being able to directly work on dependencies from the main repo might be confusing, especially if coming from a project using git submodules.
A way to ease the transition into the bender clone, bender snapshot workflow would be good. Two suggestions:

1. Make the dependencies from the .bender folder read only (RO) so that the user can't apply changes to it. This is the easiest solution but might introduce unexpected behavior:
   • Might mess with some synthesis tools?
   • Would mess with generated sources for the repo
2. Do a pass of the dependencies to check if they are dirty, before potentially overwriting changes during bender update
   • If the user has touched a repo in .bender it should be given an error stating that bender update would overwrite changes.
   • For the user to keep the changes instruct it on how to save the diff, do a bender clone, and reapply the diff in the cloned location.
     • This could be done automatically with bender clone? A flag would it wants to carry over the changes to a cloned version.
   • If the user wants to overwrite the changes a --force or -f flag could be introduced to bender update to override this behavior.

[fischeti]

Making dependencies read-only makes sense in my view, exactly because writing in .bender is dangerous since it can be overwritten at any point. Furthermore, read-only dependencies could potentially allow sharing of dependency checkouts across projects.

The main problem is that it has been kind of established that you can modify the .bender folder e.g. to regenerate files. So changing dependencies to read-only could cause quite a bit of breakage.

In theory, the problem of generated sources can be solved with the override_files flag i.e. by placing the sources outside of the .bender folder in your own project which is also cleaner in my opinion.

The dirty check could be done, but then again, modifying .bender is not really the suggested workflow. bender clone and bender snapshot are more approriate, where dirty checks are actually done iirc. But those commands are a bit newer so they are not yet very well known maybe. For that matter, we are also working on better docs #295 to explain the bender workflow a bit better.