As discussed in MDL-49840, I wish to change the way in which we install composer dependencies.

Instead of having everyone run `composer update`, which can lead to different tool versions on different people's machines, I have submitted an issue which changes the core composer wrappers in Moodle to use `composer install`.

This change requires that we as integrators must somehow run composer update to determine optimal dependencies, and update the composer.lock file. We should then checkin the lock file. This lock file is then used when running `composer install`.

Ideally we should have a Jenkins task to run:

for branch in $branches

do

  git fetch origin

  git checkout "$branch"

  git reset --hard origin/"$branch"

  curl http://getcomposer.org/installer | php

  composer update

  git add composer.lock

  git commit -m 'Automatically generated composer.lock files'

  git push origin "$branch"

done

Failing that, we need to do it manually.

We also need to determine the best time to make this change. I would suggest that we do so at something like 6am Wednesday morning AWST. This way we have an updated version of all composer dependencies for testing. The other option would be at the time we pull in issues into integration (e.g. Sunday night).

We also need to manually run composer update whenever we change the composer.json file with new dependencies. This should be an integrator task in my opinion and we should not allow composer.lock changes to be submitted with changes as these will likely conflict with the auto-generated ones.