I have found out a few extensions that are apparently deployed to Wikimedia but have their CI jobs relying on composer to install dependencies. They should be switched to use mediawiki/vendor instead.
They are configured in integration/config with the composer variant of the job, and there is even a FIXME for them. Example:
- name: mediawiki/extensions/MachineVision template: # FIXME: Document why this is using the composer variant. - name: extension-quibble-composer
That should be extension-quibble-vendor, or due to T232759:
- extension-quibble-noselenium - extension-quibble-only-selenium