A Composer plugin that validates local lockfile integrity against Git hooks

Developers pulling branches with modified composer.json files frequently forget to run composer install, running outdated dependencies locally and diagnosing bugs that do not exist.

#!/usr/bin/env bash
# .git/hooks/post-merge
if git diff-tree -r --name-only --no-commit-id ORIG_HEAD HEAD | grep -q 'composer.lock'; then
    echo "NOTICE: composer.lock has changed. Running composer check-platform-reqs..."
    composer validate --no-check-all --strict || exit 1
fi

A post-merge git hook alerting developers when composer.lock changes eliminates dozens of wasted hours chasing ghost bugs caused by stale vendor directories.