`head` goes after `sha1`, before dependencies