How can I automatically be warned if a specific file changes?

Here's an interesting gist: https://gist.github.com/sindresorhus/7996717 I've adapted it for your question.

post-merge git hook is executed when you merge branches or when you do git pull.

post-merge hook (read docs)

#/usr/bin/env bash
# MIT © Sindre Sorhus - sindresorhus.com
# forked by naXa! - naxa.by

# Git hook to run a command after `git merge` / `git pull` if a specified file was changed.
# Run `chmod +x post-merge` to make it executable then put it into `.git/hooks/`.

changed_files="$(git diff-tree -r --name-only --no-commit-id ORIG_HEAD HEAD)"

check_run() {
  echo "$changed_files" | egrep --quiet "$1" && echo "$2"
}

# In this example it's used to print a warning if composer.lock has been changed
check_run composer.lock "Run `composer.phar install --dev`"

post-checkout git hook is executed when you switch between branches or when you do git rebase.

post-checkout hook (read docs)

#/usr/bin/env bash
# MIT © Sindre Sorhus - sindresorhus.com
# forked by naXa! - naxa.by

# Git hook to run a command after `git checkout` if a specified file was changed.
# Run `chmod +x post-merge` to make it executable then put it into `.git/hooks/`.

# terminate gracefully on a file checkout (retrieving a file from the index)
# uncomment the below line if you don't want to run this hook on a file checkout (for example on git->revert in IntelliJ IDEA)
# [ $3 -eq 0 ] && { exit 0; }

changed_files="$(git diff-tree -r --name-only --no-commit-id $1 $2)"

check_run() {
  echo "$changed_files" | egrep --quiet "$1" && echo "$2"
}

# In this example it's used to print a warning if composer.lock has been changed
check_run composer.lock "Run `composer.phar install --dev`"

exit 0;

You may notice that I've changed grep to egrep here. It is done in order to be able to search using a fancy expression. For example "file1.txt|file2.txt" where | is used as an OR operator.

It depends on what option you use when pulling:

No option : git fetch and git merge are run

You can write your own post-merge git hook:

This hook is invoked by git merge, which happens when a git pull is done on a local repository. The hook takes a single parameter, a status flag specifying whether or not the merge being done was a squash merge. This hook cannot affect the outcome of git merge and is not executed, if the merge failed due to conflicts.

This hook should work for you (save this as executable file .git/hooks/post-merge):

#!/bin/sh

CHANGED=`git diff HEAD@{1} --stat -- $GIT_DIR/../composer.lock | wc -l`
if [ $CHANGED -gt 0 ];
then
    echo "composer.lock has changed!"
    composer.phar install --dev
fi

--rebase : git fetch and git rebase are run

You can write your own post-checkout git hook:

This hook is invoked when a git checkout is run after having updated the worktree. The hook is given three parameters: the ref of the previous HEAD, the ref of the new HEAD and a flag indicating whether the checkout was a branch checkout or a file checkout

This hook should work for you (save this as executable file .git/hooks/post-checkout):

#!/bin/sh

CHANGED=`git diff $1 $2 --stat -- $GIT_DIR/../composer.lock | wc -l`
if [ $CHANGED -gt 0 ];
then
    echo "composer.lock has changed!"
    composer.phar install --dev
fi

UPDATE

Here is my personal set of git hooks.