I often have it in the project root as it is required for releases.
@@ -7,6 +7,7 @@
/phpunit.xml
/phpcs.xml
/vendor
+/composer.phar
*.mo
debug.log
error.log