chore: don't ship composer.lock in the starter - #9
Merged
simonhamp merged 4 commits intoAug 30, 2026
Conversation
vipertecpro
marked this pull request as ready for review
August 2, 2026 05:22
simonhamp
reviewed
Aug 2, 2026
vipertecpro
force-pushed
the
fix/composer-install-out-of-box
branch
from
August 2, 2026 05:31
5f047d9 to
f75053c
Compare
vipertecpro
changed the title
composer install work out of the box on a fresh clonecomposer install needs no auth
Remove the committed composer.lock so a fresh clone resolves dependencies from their current sources instead of a pinned (and now stale) lock file. This matches the skeleton convention (laravel/laravel ships no lock) and fixes a fresh 'composer install' prompting for auth on nativephp/mobile-ui, which is now published on public Packagist. The nativephp-plugins repository block stays in place for premium plugins; the lock becomes the derived project's responsibility. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
vipertecpro
force-pushed
the
fix/composer-install-out-of-box
branch
from
August 2, 2026 05:55
f75053c to
924fcdb
Compare
vipertecpro
changed the title
composer install needs no auth
…out-of-box # Conflicts: # composer.lock
The daily job ran `composer update` and pushed the resulting composer.lock to main. With the lock file no longer shipped, committing it back is the one thing the job must not do - and once it can't, running an update purely to discard it buys nothing. Repurpose it instead. Because the starter ships no lock and every constraint is a caret range, what a fresh clone resolves changes daily with no commit to this repository: an upstream release alone can break `create-project`. Only a scheduled run catches that, so the cron slot is worth keeping - it just needs to assert something. The job now does what a new user does: resolve dependencies, generate a key, migrate a real SQLite file (matching how NativePHP runs migrations on device rather than the suite's in-memory database), and run the test suite. It also runs on pull requests, which this repository had no CI for at all despite shipping a test suite. Nothing is committed: the generated composer.lock is discarded explicitly and `contents: read` leaves the job no token to push with. Composer auth degrades gracefully when secrets are absent, so pull requests from forks still run - plugins.nativephp.com serves packages.json anonymously. Renamed from update-dependencies.yml, which drops that workflow's run history from the Actions tab. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Mz8swSX1LGafnvRhcfT7xf
…out-of-box # Conflicts: # composer.lock
Member
|
Thanks @vipertecpro I resolved some conflicts and improved the GH action to give us an early warning if things start failing |
Contributor
Author
|
Now everything works on the first attempt without requiring any additional steps. Simply following the documentation and running |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Remove the committed
composer.lockfrom the starter so a fresh clone installs cleanly:Why
composer installreads download URLs straight fromcomposer.lock, and the committed lock pinnednativephp/mobile-uito the private plugins registry — so a fresh clone without registry credentials hit an auth prompt on the very first install.Rather than keep regenerating a pinned lock, this follows the standard skeleton convention (e.g.
laravel/laravelships nocomposer.lock): a starter is a template, so each new project should resolve its dependencies fresh from their current sources at creation time.mobile-uiis now on public Packagist, so a fresh resolve pulls it (and everything else) with no auth. The lock then becomes the derived project's responsibility, which is where it belongs.Change
composer.lock.composer.jsonis untouched — thenativephp-pluginsrepository block stays in place for premium plugins.Verified
Fresh clone with no credentials configured →
composer installresolves and installs cleanly,mobile-uipulled from public GitHub.🤖 Generated with Claude Code