check if vendorHash is up to date

checks/vendor-hash.nix

@@ -0,0 +1,28 @@
+{
+  composerMeta,
+  src,
+  vendor,
+  stdenvNoCC,
+}: let
+  inherit (composerMeta) version name;
+in
+  stdenvNoCC.mkDerivation {
+    inherit src version;
+    pname = "${name}-check-vendor-hash";
+
+    postPatch = ''
+      ln -s ${vendor}/vendor vendor
+    '';
+
+    buildPhase = ''
+      runHook preBuild
+
+      diff -q ${vendor}/composer.lock composer.lock || (echo "vendorHash is out of date" && exit 1)
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      touch $out
+    '';
+  }

flakelight-php.nix

@@ -165,7 +165,10 @@ in
               };
             });
         in
-          (optionalAttrs hasPsalm (forPhpVersions "psalm" ./checks/psalm.nix))
+          {
+            vendor-hash = pkgs.callPackage ./checks/vendor-hash.nix {};
+          }
+          // (optionalAttrs hasPsalm (forPhpVersions "psalm" ./checks/psalm.nix))
           // (optionalAttrs hasPhpStan (forPhpVersions "phpstan" ./checks/phpstan.nix));
 
         apps = {pkgs, ...}: let
@@ -176,9 +179,11 @@ in
                   php = buildPhpVersion pkgs version;
                 })} "$@"'';
             });
-        in {
+        in
+          {
             phpunit = ''${getExe pkgs.phpunit} "$@"'';
-        } // (forPhpVersions "phpunit" pkgs.phpunit);
+          }
+          // (forPhpVersions "phpunit" pkgs.phpunit);
       })
 
       {