This is the workflow we've been using. We build the codebase using https://github.com/drupal-composer/drupal-project with the code base in the /web folder off the root of the repo.

When we need to update something such as upgrading core, you run "composer up" locally. This will update the composer.lock file.

When other developers pull down, or in a deployment script, you would run "composer install", which uses the lock file.

The line in our composer.json for Drupal core is:

"drupal/core": "~8.0",

The tilde () means any release within the 8 number (but not 9).

If you want to lock it to a specific version, you shouldn't use the tilde.

"drupal/core": "8.0-beta14",

then run "composer up" locally, commit the composer.json and composer.lock file, and then run "composer install" on other installations after pulling down the codebase.

"drupal/core": "~8.0-beta14" means any release greater than 8.0-beta14 and less than 9! You'll want to remove the tilde to lock it to a specific release. Then make sure to update your lock file by running composer up, and on the target system use composer install.

An easy way to get started is to build the codebase using https://github.com/drupal-composer/drupal-project.

When we need to update something such as upgrading core, you run "composer up" locally. This will update the composer.lock file.

When other developers pull down, or in a deployment script, you would run "composer install", which uses the lock file.

The line in our composer.json for Drupal core is:

"drupal/core": "~8.0",

The tilde () means any release within the 8 number (but not 9).

If you want to lock it to a specific version, you shouldn't use the tilde.

"drupal/core": "8.0-beta14",

then run "composer up" locally, commit the composer.json and composer.lock file, and then run "composer install" on other installations after pulling down the codebase.