Using Composer and Git in your project

Question

PHP

Good afternoon.

I have a question: I tried to use composer to use some packages in my project, and I had difficulty understanding the process of working in combination with Git for my project. What is the actual difficulty:

I write the following in composer.json:

{
  "require": {
    "psr/log": "dev-master"
  }
}

I run:

composer install

As a result, as expected, I get added folders with psr/log in the vendor folder . After that, I commit to my project, and ... In the repository in my vendors folder , only the psr/log folder is added , but the files themselves that I got after installing via composer are missing.
That is, these files are on the local machine, everything works. But in the repository of my project - there are no files, only the psr/log directory .

What confuses me: after composer install , a .git/ folder is created along with psr/log with files (config, description, index, branches/, hooks/, etc.). I understand correctly that the psr/log folder is nowI have linked to this project's repository, which is merged via composer?

If so, how should I build the process of adding packages through composer so that they can be easily committed to the repository of my project? Do I need to manually rebase the repository for each added package? Or do I need to remove the .git/ directory after importing the package into my project?

In general, I am interested in the most optimal and simple process of adding packages from my own project. I'm not completely familiar with Git, so maybe I'm missing something quite obvious?

Answer 1

Don't worry, the versions will be fixed, here's an approximate principle of operation:
When you do a "composer.phar update", the latest changes are pulled from the repositories, and their versions are written to composer.lock.
It is important to put composer.lock in the git of your project.
In the case of a new installation of the project, you need to run “composer.phar install”, then exactly the versions that we have fixed in composer.lock will be installed

Answer 2

When deploying a project, it is often necessary to perform not only copying files from the repository, but also installing software (php, mysql, curl, gearman, etc.) and performing migrations to populate the database and something else. Importing external dependencies is one such operation.
And by fixing the package versions by adding composer.lock to the project repository, you are guaranteed to get exactly the package versions that were used during development.

Answer 3

It is usually assumed that external dependencies are installed via composer. There is no point in keeping them in your repository.
PS But I thought about your question ... You
never know what requirements the project may have, if I find an answer, I'll write it off.

Answer 4

www.nabito.net/how-to-safely-commit-vendor-dir-wit...