search

outlandishideas / wpackagist

WordPress Packagist — manage your plugins with Composer
https://wpackagist.org
MIT License
704 stars 71 forks source link

Do you support the `packagist` `v2` metadata format? #479

Closed jeffwidman closed 1 year ago

jeffwidman commented 1 year ago

While working on:

I was updating our test fixtures to match what the new packagist v2 metadata API returned, and noticed that we have several test fixtures for wpackagist responses:

As far as I can tell, these responses don't have an equivalent v1->v2 metadata response, so I don't need to update them at all... Is there any plans for that in the future?

Also, my apologies if I misunderstand how wpackagist works... I'm a bit unclear as it seems like it's trying to match the packagist interface for wordpress plugins that are only available via SVN and not via repo.packagist.org, but maybe that's not the intent?

NoelLH commented 1 year ago

Hi @jeffwidman, I think that summary matches my understanding of what Wpackagist is doing. Certainly the source code has to come via SVN because that's how the WordPress repository keeps it.

I'm not aware of imminent plans to add v2-specific properties, but I'm not against it if there is some benefit. This is why I made #408 where this was discussed blocked I think, as I am not clear what particular properties would be helpful to add in terms of use alongside Dependabot.

I think it's safe to say that if nobody with a deeper understanding proposes specific additions, we'll probably stick to v1 metadata for right now.

jeffwidman commented 1 year ago

Sticking with v1 sounds reasonable for now.

For v2, the two primary benefit we saw on Dependabot were:

  1. minified metadata reduced filesizes significantly for packages that had released many versions. If wpackagist already truncates the versions to only the last few releases, then this will be minimal benefit.
  2. some caching / update frequency benefits, but those were specific to packagist, and won't be applicable to wpackagist.
NoelLH commented 1 year ago

Thanks for confirming @jeffwidman. I'll close this for now, but certainly open to any more thoughts anyone has on this.

onspli commented 2 months ago

Hi @NoelLH , I am facing the requirement to use JFrog Artifactory to mirror Wordpress Packagist. However Artifactory does not support composer v1 repository format; it needs "metadata-url": "/p2/%package%.json" endpoint to be implemented.

Are there any plans to support this format or are there any blockers? I have the resources to implement this feature myself, would you be open to a PR?

jeffwidman commented 1 month ago

IF this endpoint does get implemented, please let us over in :dependabot: know so that we update our test fixture responses... I'm subscribed to this issue for updates, but feel free to file an issue (or even directly open a PR) against https://github.com/dependabot/dependabot-core/ in case I don't see this for some reason.