composer.lock doesn’t need to be in repo