deploying composer-managed code to production without CI tools

There seems to be this gap in documentation:  When to track vendor in git?  I think the answer is whenever you’re not using CI tools for deploying to production.  What do you think?  If I’m correct then it’s probably very common (among little people devs) that we should be tracking vendor in git, but doing so does not seem to be documented on drupal.org at all.

It’s commonly said you should NOT run composer in production:

People who use fancy CI tools for deployment (like every single developer who has written a blog article on the topic) can follow the “standard” of .gitignoring vendor.

But little people who have no need for CI tools still have to deploy the code somehow, and git really makes the most sense for this.  So if you’re not using CI tools like Ansible/Puppet/CircleCI/etc to deploy code to production then you should probably use git, and that means tracking vendor.

Right?

And if you are tracking vendor, you should add something like **/.git* to your .gitignore file to avoid broken git submodule nightmare.

Right?

What else?

Corrections?  Additions?  Insight to share?

Drupal version: 


Source: https://www.drupal.org/taxonomy/term/22/feed