The lockfiles that reproduce a site's dependencies, instead of the dependencies themselves.
Measured on this workspace: vendor/drupal/core compresses to 18,105,473 bytes, and the
composer.lock that reproduces the entire 241 MB vendor/ tree exactly compresses to 41,364.
That is 440x smaller than core's bytes alone, and it is not an approximation - a lock file plus
composer install produces the same tree, which is the whole reason lock files exist.
So vendor/ is never stored. What is stored is the lock, plus a content hash of the tree it
produced, so VendorDriftDetector can notice when the tree stops matching the lock - a patched
dependency, a hand-edited file, a partial install - and only then are the files that drifted
captured as bytes.
The whole code realm costs 8.98 MiB a year at 150 deploys, which is 0.09% of R2's free tier.
LOCKFILES = ['composer.json', 'composer.lock', 'package.json', 'package-lock.json', 'yarn.lock', 'bun.lock', 'bun.lockb', 'pnpm-lock.yaml']
Files treated as lockfiles, relative to the project root.
Both halves of each ecosystem: the manifest says what was asked for and the lock says what was resolved, and a restore needs the second to reproduce anything.
__construct(string $path, string $digest, int $bytes = 0, int $modified = 0) : mixed
Constructs a reference.
| string | $path | The file's path relative to the project root. |
| string | $digest | Content address of the file. |
| int | $bytes | Its size. |
| int | $modified | Unix timestamp it was last written. |
matches(self $other) : bool
Whether this reference describes the same file as another.
| self | $other | The other reference. |
TRUE when the paths and digests agree. The timestamp is ignored: a file rewritten with
identical content is not a change, and composer install rewrites timestamps freely.