🚢 Ship composer and package lock files

[AndyScherzinger]

How to use GitHub

• Please use the 👍 reaction to show that you are interested into the same feature.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Is your feature request related to a problem? Please describe.
Currently it is not possible to run a license scan on a package/build since we do not ship composer.lock and package-lock.json.

Describe the solution you'd like
Ship composer and package lock-files in our release archives for server and the apps in the release archive(s)

Describe alternatives you've considered
Currently none. A scan would be possible based on the release tags while that is not the same source as being able to do this based on the content of a release tar-ball.

[AndyScherzinger]

Afaik done, no? @juliushaertl

[juliusknorr]

Server bit not merged yet.

[blizzz]

Server bit not merged yet.

link?