How we use composer

| 25.02.2015

It's almost a year ago. The developer days in Eindhoven 2014. It was the time we promised to publish how we use composer. It's a bit late now, but hereby our view on composer.

Composer is a great tool for managing your dependencies. That means it nicely pulls in code.
Unfortunately it had some issues over time, so we decided it's a tool that we use only on development and integration environments.

To pull in the packages we host on our private repositories we use Satis. There's enough to read on the internet how to set that up. If you think about setting up your own satis have a look at Toran Proxy too. We didn't get to that yet, but it's a good way to support composer.

And now the interesting part. If you pull in packages using composer it does add some extra work to your workflow. This work is
completely fine for packages that you use over multiple projects as you really want to tag that code and share it between
projects. But what happens if you start creating a package that you will never ever use outside the current project? Wouldn't it then be easier to add it to your main distribution repository?

We chose to add them to our projects main distribution repository. Such a repository is similar to the Neos base distribution. It contains a composer.json, composer.lock and .gitignore file. In our .ignore file we ignore the Packages/ folder,
and have specific excludes for packages we include in the main repository. This could for example be a site package for Neos.
In that case the .gitignore would look like:



This means all packages are excluded except those below Packages/Sites. In addition we might create additional packages for which we don't know yet if we will ever re-use them. If that happens we kickstart them in the main repository. If it turns out to
be useful to put the package in it's own repository at a later time we can always do that. For such a package we add the
following to the .gitignore:



This way most code related to the project is actually inside the main repository, and composer just pulls in the other
packages. And as you noticed, no submodules around ;-)

Hope this is of help to anyone. And you're welcome to post your ideas below if you like.