Current best practice is to commit this https://bundler.io/man/bundle-install.1.html#THE-GEMFILE-LOCK but we have zero deps, so it doesn't make sense