"install" update github references

[vbfox]

Description

paket install can change github references in paket.lock making them point to the latest commit.

Repro steps

Please provide the steps required to reproduce the problem

1. Checkout https://github.com/ionide/ionide-vscode-paket
2. run build.cmd -> OK
3. run .paket\paket.exe install
4. run build.cmd -> Failure
5. Look at paket.lock, Octokit.fsx dependency changed from fsharp/FAKE 43c4800c5f132d2c2d6832a3a59232a64d83d4c0 to c063bf415dac7f7d4df4c37fe76badce76cae3c3.

Expected behavior

install shouldn't change the lock file as there is no reason to change it here (Well it remove the specs: markers but that's not a functional change just a cosmetic one)

Actual behavior

install updates Octokit.fsx to the latest version but not it's Octokit dependency from nuget producing build failures.

If there is a reason that I don't understand for this update to happens, the dependencies should be updated too as in the current state there is no paket update for github dependencies so the only way to update Octokit there is to hand-edit paket.lock.

Known workarounds

• Deleting Octokit from paket.lock and re-running an install to get the latest of everything
• Pinning the github dependency to a specific version might help

Related information

Tests done on version 3.3.4.0.

PS: Aditionally whatever I do I always have #1750 warning so there's still a bug around this feature :)

[vbfox]

Great success !