fix: add composer.lock to the repository#1003
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds composer.lock to version control to make PHP dependency installs reproducible across developers, CI, and production, aligning the repo with Composer’s recommended workflow and enabling Dependabot to manage lockfile updates.
Changes:
- Stop ignoring
composer.lockso it can be committed and tracked. - Remove the CI step that runs
composer update(which would otherwise churn the lockfile on every run). - Update contribution guidelines to require
composer.lockupdates alongsidecomposer.jsonchanges.
Reviewed changes
Copilot reviewed 2 out of 4 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
composer.lock |
Added to the repository to lock dependency versions for reproducible installs. |
.gitignore |
Removes the ignore rule for composer.lock so it can be tracked. |
.github/workflows/lint-and-analyse-php.yml |
Removes the lockfile-updating step; CI now validates composer.json/composer.lock instead of mutating them. |
CONTRIBUTING.md |
Adds guidance to keep composer.json and composer.lock in sync within the same PR. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
JohnVillalovos
force-pushed
the
jlvillal/composer_lock
branch
2 times, most recently
from
1edc042 to
e918c0b
Compare
JohnVillalovos
force-pushed
the
jlvillal/composer_lock
branch
2 times, most recently
from
2d08b0e to
76a579a
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 5 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
JohnVillalovos
force-pushed
the
jlvillal/composer_lock
branch
from
76a579a to
f498896
Compare
We are now running dependabot on a weekly basis and it will automatically do a PR to update the `composer.lock` file. The Composer docs recommend to commit the lock file: https://getcomposer.org/doc/01-basic-usage.md#commit-your-composer-lock-file-to-version-control Benefits mentioned are: * Reproducible installs: everyone (dev, CI, prod) gets the exact same dependency versions. * Fewer “works on my machine” issues. * Safer deploys: updates happen only when you intentionally run composer update. * Better debugging/auditing: lock diff shows exactly what dependency changed. * Faster, more stable CI pipelines.
JohnVillalovos
force-pushed
the
jlvillal/composer_lock
branch
from
f498896 to
04979e6
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 3 out of 5 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
1 participant
We are now running dependabot on a weekly basis and it will automatically do a PR to update the
composer.lockfile.The Composer docs recommend to commit the lock file: https://getcomposer.org/doc/01-basic-usage.md#commit-your-composer-lock-file-to-version-control
Benefits mentioned are: