You may find this discussion useful:
TL;DR: I am using a repository with Manifest.toml committed for the project.
Manifest.toml