The build process errors without a composer.lock

[effulgentsia]

Expected Behavior

This project's README says:

Use of a composer.lock file will enable caching of the downloaded dependencies, such that subsequent builds with the same composer.lock file will not need to run composer install again.

Based on that, I would expect the composer.lock file to be optional, and for composer install to still be executed without it; I would just not benefit from caching (or from the other benefits of having a composer.lock).

Current Behavior

The build process fails with the following message at the end:

 Executing build process
failed to calculate checksum: lstat /workspace/composer.lock: no such file or directory

I'm guessing that's due to this code line, but I'm not sure.

Possible Solution

Either add code to handle the case of a non-existent composer.lock. Or, if the intent of this buildpack is for composer.lock to be required, then check for it in the detection phase, and don't run the buildpack at all without it.

Steps to Reproduce

Motivations

One use-case of wanting to have a composer.json without a composer.lock is if I want my built container to end up with having Composer installed on it, available for use at runtime. In this case, I want the "composer" buildpack to detect the composer.json, which I can do with simply {} as my composer.json.

Another use-case is if I want to use composer.json to specify my PHP version dependency and PHP extension dependencies, but I don't necessarily need any packages installed.

In both cases, I can add a composer.lock anyway, but it just feels like clutter to have it.

Some people might have the use-case of wanting a composer.json with package dependencies included, but not wanting to lock those dependencies with a composer.lock. I personally do not have that use-case at the moment.