&gt; It&#x27;s not, if you can not even run that first build then you actually have nothing to work on.<p>Obviously you can run the first build.  You wouldn&#x27;t be using Github if you never got it working in the first place.<p>To clarify, <i>setting up</i> the build environment may require network access, but if the <i>process</i> of building requires it, there are many places where it can go wrong, both operationally and security wise.<p>&gt; Also, not frozen dependencies means you are at the mercy on any dependencies changes breaking your build at any time. ...<p>I agree, but that&#x27;s a separate discussion and doesn&#x27;t really apply here.  There&#x27;s nothing preventing the pulling of a specifically tagged version for builds.  If someone&#x27;s build process that used Git for dependencies is not doing this, whether they are using Github or some internal server is irrelevant, the same problems apply.