build/composer.lock should really be in repo