.gitignore shouldn't ignore composer.lock

[joachim-n]

# Ignore composer.lock as this is template project
/composer.lock

The problem here is that after a developer uses this template to create a project, they can't commit the composer.lock file -- which is now part of their project -- until they change this.

[andybroomfield]

We want to be careful though that those developing on this repo doesn't commit composer.lock.
(Or have the dependencies always updated, or locked to specific initial versions).

[joachim-n]

True, but making commits to this repo is something that's going to happen much less than people starting a project with this repo as a template. Also, people making commits to this repo -- more specifically, people merging PRs to this repo -- are going to be more knowledgeable about what to do than people starting a project with it.

Composer's official documentation doesn't have much on project templates unfortunately!

[andybroomfield]

Historical discussion is on #8

Just checking and drupal recommend project does have a composer.lock file (but not a .gitignore)

[stephen-cox]

Might be overkill, but we could add a Composer script that removes those lines when composer create-project is run using the post-create-project-cmd event, which would leave it in place for those who clone the repo directly.