feat(ci): auto-update composer.lock on push/schedule

[CybotTM]

Summary

Adds automatic composer update to the CI pipeline, ensuring dependencies stay fresh without manual intervention.

How it works

Trigger (push to main OR weekly schedule)
    ↓
update-deps job: composer update
    ↓
Lock file changed? 
  → YES: commit & push, output new SHA
  → NO: output original SHA
    ↓
lint job: checkout $SHA → run linting
    ↓
build job: checkout $SHA → build & release

Key implementation details

• update-deps outputs the commit SHA (new if deps changed, original otherwise)
• lint and build jobs checkout that specific SHA via ref: parameter
• This ensures the built image always matches the committed lock file state
• Works around GitHub's limitation where GITHUB_TOKEN pushes don't trigger new runs

Flow by trigger type

Trigger	update-deps	lint	build
PR	skipped	✓ (original SHA)	✓
Push (no dep changes)	runs	✓ (original SHA)	✓
Push (dep changes)	commits, outputs new SHA	✓ (new SHA)	✓
Schedule	same as push	✓	✓

Benefits

• Dependencies updated automatically on every push/schedule
• Built image always matches committed lock file
• Clear audit trail - every dep update is a separate commit
• Single workflow run handles both update and build

Test plan

• PR triggers skip update-deps, run lint & build with original SHA
• Push to main with no dep changes runs full pipeline
• Push/schedule with dep changes commits, then builds with new SHA

[Copilot]

Pull request overview

Adds an update-deps job to the existing CI workflow to automatically run composer update on non-PR runs and conditionally short-circuit the pipeline when dependency changes are committed.

Changes:

• Introduces an update-deps job that runs composer update and commits/pushes app/composer.lock when it changes.
• Gates lint and build jobs to run only when update-deps did not change the lockfile (or was skipped for PRs).
• Wires job dependencies/conditions so PRs continue to run lint/build without updating dependencies.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.