Bug report

phpstan/phpstan-src@f11c0f0 (originally discussed on #4495 (comment)) means that changes to /vendor/composer/installed.php can now invalidate the result cache.

Running composer install after HEAD has changed causes this file to be regenerated even when composer.lock has not changed because HEAD's SHA-1 hash is written to /vendor/composer/installed.php:

<?php return array (
  'root' =>
  array (
    'pretty_version' => 'dev-master',
    'version' => 'dev-master',
    'aliases' =>
    array (
    ),
    'reference' => 'b7dc13834d2087ddf8aec8b792b9fcc36880940f', // <----- HEAD's SHA-1
    'name' => '__root__',
),

This is particularly evident in a CI build process where composer.install is being run every time. In practice, we are seeing every build report "Result cache not used because the metadata do not match" even though our Composer dependencies (composer.lock) are not changing. Is there a workaround for this issue? Or an alternate solution to solve the original issue that doesn't so aggressively invalidate the cache?

Thank you in advance, and thank you for creating this wonderful tool!