Skip the vendor checks on branches with no composer.json

[darksidemilk]

What

Gate the vendor job's steps on packages/web/composer.json actually being present, so branches without one skip loudly instead of failing.

Worth merging before the next dev-branch PR — right now every one of them is red.

Why

The vendor job added in #16 assumes packages/web/composer.json exists. It does on working-1.6, where the dependency manager landed. It does not on dev-branch, and not on any branch cut before that. So the very first step fails:

Run composer validate
./composer.json not found.
##[error]Process completed with exit code 3.

That turned every dev-branch pull request red the moment #16 merged — first observed on fogproject#1161, which was the first dev-branch PR opened after 16:27 UTC.

It isn't a real finding on those branches. The absence is correct there, and the only way to make the check pass for real would be to port the whole dependency manager to the 1.5.x line — a decision with nothing to do with whether any given PR is sound.

Approach

Detect the manifest once after checkout, then gate the PHP setup, composer validate, composer install, the content comparison and the drift report on it. When it's missing the job emits a ::warning:: plus a step-summary line saying so, and passes.

Skip loudly rather than fail — or silently pass — because that's what this repo already does with exactly this class of problem. update-lang-fix-psr-and-sync-version.yml skips update-language.sh with a ::warning:: on branches that predate it, "rather than failing the whole job on a branch nobody can fix without rebasing". Same reasoning, same shape.

The drift report keeps its always(), so it still reports after a failed content comparison. It just also requires the manifest, since Composer was never installed in the skip case and that step shells out to composer --version.

Verified

• actionlint clean.
• Guard evaluated against both real branches: present=true on working-1.6, present=false on dev-branch.
• Nothing changes on working-1.6 — the manifest is there, so every step runs exactly as before. If the 1.5.x line ever gains a composer.json, this starts checking it with no further change here.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PqufBbuckux8kitJeW3uAK

[darksidemilk]

Superseded by #19, which landed the same guard (detect packages/web/composer.json after checkout, gate the composer steps on it, skip with a step-summary note otherwise). Same reasoning, same shape, already on main — nothing here to add. Closing.