put composer.lock in the repo for deployment