This is probably out of scope for this article, but I’m curious as to how you’d handle vendor-dependencies (npm/bower/composer packages obtained from a 3rd party) using this approach? A post-deployment hook on the remote server maybe to download new packages?