[CI] composer cache not using latest depencies

[jrushlow]

Without a lock file, composer cache in CI doesn't always use latest builds of dependencies.

• temp. disable composer cache to use latest dev dependencies
• solution to invalidate cache without a composer.lock file

[kbond]

I have also run into this (same with caching the phpunit directory). I never did find a solution to either and ended up just disabling the cache as well.

[stof]

Well, the issue was that you were trying to skip the composer install entirely when the cache was a hit. But a hit based on composer.json is not enough for that.
You could still cache the composer cache, but without skipping the install entirely (an install from a warm cache will still help)