News for hackers. Stuff that matters.

A comment on What, why and how of PHP Composer. Parent comment

Re:What, why and how of PHP Composer by stunt on Thursday June 14, 2018 @03:45AM (#17310083)
You always choose a reliable dependency not something random. I never had similar experience or saw a project doing that.

You should only version composer.lock and composer.json files. Ignore vendor directory and leave that job to your build step in CI/CD...

[ Parent | on HN ]
Re:What, why and how of PHP Composer by mnemnc on Thursday June 14, 2018 @04:26AM (#17310237)
That's why we have our own composer repository powered by satis. When set up correctly, it can be used as a "proxy" for packagist, ensuring you always have an installable version of your dependencies, even if they are not available via packagist anymore.
[ Parent | on HN ]
Re:What, why and how of PHP Composer by dotancohen on Thursday June 14, 2018 @07:22AM (#17310804)
Most insightful comment on this thread. I'm looking into satis now, thank you!

https://github.com/composer/satis

[ Parent | on HN ]
Re:What, why and how of PHP Composer by viraptor on Thursday June 14, 2018 @04:06AM (#17310170)
Things disappear, or get deleted, or old versions get replaced for various reasons. There's no "reliable dependency". Even if you think something's reliable, sone deeper dependency may disappear. See npm and left-pad for example.

Committing vendor directory may or may not be a good idea. But having your own copy of all dependencies (current and past) is necessary.

[ Parent | on HN ]
Re:What, why and how of PHP Composer by marenkay on Thursday June 14, 2018 @04:23AM (#17310226)
> But having your own copy of all dependencies (current and past) is necessary.

Definitely! Git mirrors are cheap, and there are various solutions for composer proxies out there. If you consider CI/CD you will want freedom from external calls anyway.

[ Parent | on HN ]