We should run the checkComposerLockUpToDate.php script after creating a new WMF deployment branch to ensure the dependencies required by MediaWiki core are all present in the branched version of mediawiki/vendor.
With T90303 it will be technically possible for the two repositories to get out of sync so we should have a last, final check before deploying.
This could be done by sending the initial branch creation commit to gerrit and having jenkins run tests against it, but that could be slow. The deployer could also run the script locally, but it requires MW to be set up. Assigning to twentyafterfour to figure out which one he prefers. We also discussed this in IRC (logs: http://bots.wmflabs.org/~wm-bot/logs/%23wikimedia-releng/20150605.txt).