Add composer.lock and ignore composer files in vendor