I would like to run phpunit in a Gitlab CI. Nix devShell will be used to provide PHP and Gitlab provides a MariaDB container.
Composer brings in some form the additional dependencies.

In an existing project we use imperative containers for the unittests.
Each containers brings a vendor directory that is based on the composer.lock from the main branch.
In the pipeline composer install then only has to install packages that have changed compared to the main branch, which often are none.
This way it's faster and we don't hammer packagist.org.

What I tried so far is a fixed output derivation which looks like the following.
In the pipeline I then simply copied the content into the build directory and rebuilt the autoloader.
It is hacky but it worked in principle, until I noticed that the outputHash changed on the runner, compared to my computer.

stdenvNoCC.mkDerivation {
  name = "composer-dependencies";
  src = composerFiles;
  nativeBuildInputs = [ php83Packages.composer ];
  buildPhase = ''
    export COMPOSER_HOME=$TMPDIR
    composer install --no-interaction --no-scripts --no-ansi --no-autoloader --no-dev
  '';
  installPhase = ''
    mkdir -p $out/
    cp -r vendor $out/
  '';
  dontFixup = true;
  outputHashAlgo = "sha256";
  outputHashMode = "recursive";
  outputHash = "sha256-sK2CvCMvlAAPdaeXLl6LwKAUJeiw9p6zXVxio6y0w0c=";
}

{
  composerDependencies,
  lib,
  php83Packages,
  root,
  stdenvNoCC,
}:
let
  fs = lib.fileset;
  sourceFiles = fs.unions [
    (root + "/composer.json")
    (root + "/composer.lock")
  ];
  composerFiles = fs.toSource {
    fileset = sourceFiles;
    inherit root;
  };
in
stdenvNoCC.mkDerivation {
  name = "composer-dev-dependencies";
  src = composerFiles;
  nativeBuildInputs = [ php83Packages.composer ];
  buildPhase = ''
    cp -r ${composerDependencies}/vendor vendor
    chmod -R 755 vendor
    export COMPOSER_HOME=$TMPDIR
    composer install --no-interaction --no-scripts --no-ansi --no-autoloader
  '';
  installPhase = ''
    mkdir -p $out/
    cp -r vendor $out/
  '';
  dontFixup = true;
  outputHashAlgo = "sha256";
  outputHashMode = "recursive";
  outputHash = "sha256-oHkogPJiwXE+XBJxh0yTsFRYptLkgCG5v6ExFuef72Y=";
}

1. my-app -> would be made with buildComposerProject, using regular attributes. This is ready to go in prod if needed, it doesn't contain any require-dev stuff.