In CR comments on https://gerrit.wikimedia.org/r/#/c/135290/ it has been proposed that we make a git clone of the MW core not be installable until $IP/vendor is populated somehow -- either by separately cloning the mediawiki/core/vendor project, or preferably by running composer to obtain dependencies.
I have suggested, as a compromise, to make the vendor directory be a submodule pointing to mediawiki/core/vendor. Then users can either run "git submodule update --init" to obtain dependencies, or they can omit submodule initialisation and instead run composer.
I would like to hear more comments on this.
-- Tim Starling