Merge pull request #187 from strk/vendor

Add vendoring section

CONTRIBUTING.md

@@ -57,6 +57,17 @@ After running for a while, the command should print
 ```
 ALL TESTS PASSED
 ```
+## Vendoring
+
+We keep a cached copy of dependencies within the `vendor/` directory,
+managing updates via [govendor](http://github.com/kardianos/govendor).
+
+Pull requests should only include `vendor/` updates if they are
+part of the same change, be it a bugfix or a feature addition.
+
+The `vendor/` update needs to be justified as part of the PR description,
+and must be verified by the reviewers and/or merger to always reference
+an existing upstream commit.
 
 ## Code review