Rebuild package without dev dependencies

[jhedstrom]

• Addresses Remove Composer dev dependencies from package output #289

[grayside]

Can anyone think of a reason someone would create a task that executes package followed by a composer operation that needs -dev?

[arithmetric]

@grayside That would only be a problem if also executed in the packaged output, right? The dev dependencies will still exist in the project root.

[arithmetric]

It looks like the tests are failing for D7. Can this Composer task be conditional on if the Composer build process is used?

[grayside]

Is this recursive? Is it a problem if it finds composer.lock but composer.json is missing?

[jhedstrom]

It shouldn't be recursive, it's just looking at the actual projFiles array specification (composer.* is the pattern in the test config).

[grayside]

The latest commit raises a question to my mind:

If Drupal core has a composer.json and the project has it's own composer.json... how do we put both into the Drupal docroot and run composer install? Shouldn't that recurse reality?

[jhedstrom]

how do we put both into the Drupal docroot and run composer install? Shouldn't that recurse reality?

This expects the following packaged structure:

\
composer.json
composer.lock
README.md
...
build\
  html\
  index.php
  ...
  core\
    composer.json

Note there is no composer.json file at the docroot, only in core. This differs from downloading a tarball of core, or using the core git repo directly since those do include a docroot-level composer.json file. The recursion there is handled by wikimedia/composer-merge-plugin, which then descends into the core directory.

[grayside]

Does the composer install --no-dev re-download already downloaded dependencies?

[jhedstrom]

Not once there is a .lock file. In manual testing it takes a matter of seconds since the libraries are cached by composer.

[jhedstrom]