Fix GitHub Actions setup-composer fallback lockfile handling (#342)

.github/actions/php/setup-composer/action.yml

@@ -106,7 +106,7 @@ runs:
       with:
         working-directory: ${{ inputs.dev-tools-source-directory }}
         composer-options: --prefer-dist --no-plugins --no-scripts
-        require-lock-file: 'true'
+        require-lock-file: 'false'
         custom-cache-suffix: dev-tools-runtime
 
     - name: Expose DevTools runtime

CHANGELOG.md

@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Fixed
+
+- Relax workflow fallback Composer install so .dev-tools-actions bootstrap does not require composer.lock when provisioning DevTools runtime in shared GitHub Actions contexts (#342).
+
 ## [1.25.4] - 2026-05-11
 
 ### Fixed

tests/GitHubActions/SetupComposerActionTest.php

@@ -103,6 +103,19 @@ public function detectRuntimeWillPreferTheConsumerLocalInstallation(): void
         self::assertSame($resolvedWorkspace . '/vendor/autoload.php', $outputs['autoload']);
     }
 
+    /**
+     * @return void
+     */
+    #[Test]
+    public function fallbackInstallShouldNotRequireComposerLockFile(): void
+    {
+        $actionFile = self::ACTION_PATH . '/action.yml';
+        $actionContents = file_get_contents($actionFile);
+
+        self::assertStringContainsString("require-lock-file: 'false'", $actionContents);
+        self::assertStringNotContainsString("require-lock-file: 'true'", $actionContents);
+    }
+
     /**
      * @return void
      */