Composer Install Package From Github, lock npm ci using a hash of package-lock.