Show HN: Inrepo – Pull upstream repos into your app without forks or submodules

Description and use

**Brief Summary (2‑3 sentences)**
Inrepo is a lightweight tool that lets you pull the source of an upstream Git repository directly into your own project without creating a fork or using submodules. It works by fetching the upstream files at build time, letting you keep a single source of truth while still customizing the integration locally. The project is actively maintained (last update 2026‑05‑11) and targets developers who need a quick, fork‑free way to embed external code.

**Value**

• **No forks or submodules:** Eliminates the overhead of maintaining separate forks or dealing with submodule versioning, reducing repository clutter.
• **Up‑to‑date imports:** Pulls the latest upstream changes automatically, ensuring you stay current with bug fixes and security patches.
• **Simple workflow:** Works with standard Git commands and can be scripted into CI pipelines, making it easy to adopt in existing build processes.

**Practical Adoption Path**

1. **Evaluate the upstream repo** – Verify the license, activity, and issue health of the target repository.
2. **Add Inrepo as a dev dependency** – Install via npm/yarn (or the language‑specific package manager) and configure a small .inrepo.yml file that lists the repos and paths you want to import.
3. **Integrate into the build** – Add a pre‑build step (e.g., npm run inrepo:sync) that runs Inrepo to fetch the upstream files into a designated folder in your codebase.
4. **Test locally** – Run your test suite to confirm that the imported code compiles and behaves as expected.
5. **Lock versions** – Pin specific commit hashes or tags in the config to avoid accidental breaking changes, and optionally set up a scheduled CI job to refresh the lock and run tests.

**Production Readiness**

• **Maturity:** Medium – suitable for prototypes, internal tools, or services where the imported code is not a critical security boundary.
• **Risks:** Sparse documentation and limited community signals mean you should perform due diligence on licensing, maintenance cadence, and issue resolution of both Inrepo and the upstream repos.
• **Mitigations:** Pin exact commits, add automated tests for the imported code, and monitor upstream repositories for breaking changes. With these safeguards, Inrepo can be safely promoted to production for non‑core components, while core or high‑risk dependencies may still warrant a more traditional dependency management approach.

Use in a workflow

Show HN: Inrepo – Pull upstream repos into your app without forks or submodules may be useful when its README and activity match a concrete workflow.

Limitations and review notes

Medium: useful for prototypes or internal workflows, with dependency and maintenance checks before production.