.gitea/workflows/ci.yml

@@ -34,7 +34,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: /composer/cache
-          key: composer-${{ hashFiles('composer.json') }}
+          key: composer-${{ hashFiles('composer.lock') }}
 
       - name: Install dependencies
         run: composer install --prefer-dist --no-progress --no-interaction
@@ -67,7 +67,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: /composer/cache
-          key: ${{ matrix.php }}-composer-${{ hashFiles('composer.json') }}
+          key: ${{ matrix.php }}-composer-${{ hashFiles('composer.lock') }}
 
       - name: Install dependencies
         run: composer install --prefer-dist --no-progress --no-interaction

.gitea/workflows/release.yml

@@ -41,7 +41,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: /composer/cache
-          key: composer-${{ hashFiles('composer.json') }}
+          key: composer-${{ hashFiles('composer.lock') }}
 
       - name: Install dependencies
         run: composer install --prefer-dist --no-progress --no-interaction

.gitignore

@@ -1,5 +1,4 @@
 vendor/
-composer.lock
 coverage/
 .phpunit.result.cache
 *.log

bin/build-zip.sh

@@ -23,6 +23,10 @@ INCLUDE=(
 	"$SLUG.php"
 	"uninstall.php"
 	"composer.json"
+	# Staged so the production install below resolves to the locked versions
+	# rather than whatever is newest that day. Both are deleted again before
+	# the zip is written.
+	"composer.lock"
 	"src"
 	"templates"
 	"assets"