Recommendation: Add composer.lock file to version control

[jmondragon]

There are a couple of discussions on this here:laravel/framework and here: StackOverflow

Also, the recommendation from the composer docs is here: Composer

Checking composer.lock into the repository is recommended for applications (but not necessarily for libraries).

Ultimately, of course, it'll be your decision on whether or not to include the composer.lock file, and whether Winter CMS is considered a library or an application, but from my recommendation stems from the fact that Cloud Native Buildpacks (CNB) that are used by GitLab AutoDevOps (and Dokku, Heroku, OpenShift, etc.) depend on it.

Including the composer.lock file would allow me to deploy to these platforms directly from the (forked) repository rather than checking it out, running composer install, modifying the .gitignore file and checking it back in.

[bennothommo]

Like with the Laravel framework issue that you linked, the expectation is that you would remove the line in the .gitignore file that ignores composer.lock and deploy the composer.lock with your application. We ignore it in the main repo to stop people accidentally including it in PRs or commits.

[jmondragon]

Thank you for your reply. I understand the reasoning, and it does make sense for the main repo so people don't include it in PRs as you mention.

Thank you