Why does my deploy log say `No composer.lock file present` when I really do have a `composer.lock`?

I’m deploying a Drupal 8 or 9 site, and although things seem to work OK, my deploy log contains the confusing message:

Changed current directory to /app/.global/composer/composer
    W: No composer.lock file present. Updating dependencies to latest instead of installing from lock file.

And composer seems to be running twice.
 

I have committed a composer.lock file, and that should be getting used.
 

What’s going on?

This is because composer is running twice, 1st to get/update its own version of composer then second to install your application dependencies.

The warning is ONLY for the first run and has no impact on your project. The second run does infact read your composer.lock and installs dependencies from it. See if you deploy log like so:

Installing build dependencies...
    Installing php build dependencies: composer/composer <--- this is the first run that updates composer
    W: Changed current directory to /app/.global/composer/composer
    W: No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
    W: Loading composer repositories with package information
    W: Updating dependencies
    W: Lock file operations: 26 installs, 0 updates, 0 removals <--- this is the second run which reads your lock file

So, you can safely ignore this warning.