Because the we set allow-picked-versions to false in order to ensure
build reproductibility, it makes sense to also enforce code checked out
from git is checked out at a fixed revision