From 4faf9c213e6f9e02c28852254ddf6cc712246cef Mon Sep 17 00:00:00 2001
From: Sandro Santilli <strk@kbt.io>
Date: Wed, 16 Nov 2016 19:12:04 +0100
Subject: [PATCH] Add vendoring section

Closes #178
---
 CONTRIBUTING.md | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 1609db2a8..df1e0e6d7 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -57,6 +57,17 @@ After running for a while, the command should print
 ```
 ALL TESTS PASSED
 ```
+## Vendoring
+
+We keep a cached copy of dependencies within the vendor/ directory,
+managing updates via [govendor](http://github.com/kardianos/govendor).
+
+Pull requests should only include vendor/ updates if they are
+part of the same change, be it a bugfix or a feature addition.
+
+The vendor/ update needs to be justified as part of the PR description,
+and must be verified by the reviewers and/or merger to always reference
+an existing upstream commit.
 
 ## Code review