diff --git a/.github/workflows/fogproject-tests.yml b/.github/workflows/fogproject-tests.yml
index 7d49fcd..28cfcc3 100644
--- a/.github/workflows/fogproject-tests.yml
+++ b/.github/workflows/fogproject-tests.yml
@@ -104,7 +104,34 @@ jobs:
       - name: Check out the pull request
         uses: actions/checkout@v4
 
+      - name: Does this branch have a composer tree?
+        id: composer_tree
+        # This workflow is shared by every fogproject branch, and only the
+        # 1.6 line has a composer tree -- committed vendor/ arrived with
+        # Phase 0.3. dev-branch has no packages/web/composer.json at all, so
+        # `composer validate` exited non-zero there and EVERY dev-branch pull
+        # request showed a red check for a file it is not supposed to have.
+        # A red check that is always red teaches people to ignore red checks,
+        # which costs more than the job is worth.
+        #
+        # Decided from the tree rather than from the branch name, because the
+        # branch that has a composer tree is a thing that will change and the
+        # presence of the file is the actual precondition.
+        run: |
+          if [ -f packages/web/composer.json ]; then
+            echo 'present=true' >> "$GITHUB_OUTPUT"
+          else
+            echo 'present=false' >> "$GITHUB_OUTPUT"
+            {
+              echo '### vendor/'
+              echo ''
+              echo 'No `packages/web/composer.json` on this branch, so there'
+              echo 'is no locked dependency tree to verify. Skipped.'
+            } >> "$GITHUB_STEP_SUMMARY"
+          fi
+
       - name: Set up PHP 7.4 and Composer
+        if: steps.composer_tree.outputs.present == 'true'
         uses: shivammathur/setup-php@v2
         with:
           # 7.4 because composer.json pins config.platform.php to 7.4.0. The
@@ -117,6 +144,7 @@ jobs:
           coverage: none
 
       - name: Validate composer.json against composer.lock
+        if: steps.composer_tree.outputs.present == 'true'
         # Not --strict: it fails on the "version field is present" advisory,
         # and that field is deliberate -- FOG is not published on Packagist
         # and the installer reads its own version from the tree. Plain
@@ -126,10 +154,12 @@ jobs:
         working-directory: packages/web
 
       - name: Reinstall from the lock
+        if: steps.composer_tree.outputs.present == 'true'
         run: composer install --no-interaction --no-progress
         working-directory: packages/web
 
       - name: Compare package content
+        if: steps.composer_tree.outputs.present == 'true'
         # The exclusions are the point of this step. vendor/composer/* and
         # vendor/autoload.php are Composer's own scaffolding, and their bytes
         # are a function of the COMPOSER BINARY, not of composer.lock --
@@ -151,7 +181,11 @@ jobs:
         # worth seeing: a change here means the tree was last regenerated by a
         # different Composer, which is the thing to know before believing a
         # vendor diff in some later pull request.
-        if: always()
+        #
+        # always() so it still reports when an earlier step failed, AND the
+        # tree check, so it does not run `composer --version` on a branch
+        # where Composer was never installed.
+        if: always() && steps.composer_tree.outputs.present == 'true'
         run: |
           {
             echo '### vendor/'