search

maglnet / ComposerRequireChecker

A CLI tool to check whether a specific composer package uses imported symbols that aren't part of its direct composer dependencies
MIT License
901 stars 73 forks source link

Missing composer.lock in release #549

Closed patka-123 closed 1 month ago

patka-123 commented 1 month ago

Hello,

From release 4.10.0 onward the composer.lock file has been removed from the release tarball. Is this unintentional or was this done on purpose? I'm asking because I'm maintaining the Nix package, and we build from source and require the lock-file.

Is it possible to get it back?

SvenRtbg commented 1 month ago

I think this was the PR back then: https://github.com/maglnet/ComposerRequireChecker/pull/530

patka-123 commented 1 month ago

Thanks for the link!

Excluding the composer.lock in there does seem like a mistake though. ComposerRequireChecker is meant as a standalone cli app as is explained in the readme, and as such it is important to keep the lock file.

In some cases where the project is a library one might choose to not include a lock file, but even that is no longer a recommendation according to the Composer documentation.

I'll create a PR to put it back, if that's ok

fredden commented 1 month ago

we build from source and require the lock-file.

The lock file /is/ in the source. How are you obtaining a copy of the source code at a certain version?

Ocramius commented 1 month ago

@patka-123 if you build from source, please don't use the artifact.