only keep composer.json under version control