search

pixelfear / composer-dist-plugin

Composer package that downloads distributable assets to be used in packages so you don't have to commit them.
MIT License
28 stars 2 forks source link

Allowed plugin config? #9

Closed connor11528 closed 2 years ago

connor11528 commented 2 years ago

Hi there, I got a bit of a surprise from this package when running a composer install:

$ composer install
pixelfear/composer-dist-plugin contains a Composer plugin which is currently not in your allow-plugins config. See https://getcomposer.org/allow-plugins
Do you trust "pixelfear/composer-dist-plugin" to execute code and wish to enable it now? (writes "allow-plugins" to composer.json) [y,n,d,?]

Is this a side affect from installing Statamic? I'm not totally clear what this package does or how it relates to Statamic, but maybe we should just add it as an allowed plugin to our composer.json file? Would be helpful to have an example allowed-plugins config block in the Readme if that is the best course of action :)

I am running PHP version 7.4.27 and Composer version 2.2.5

This is our composer.json file:

{
    "name": "laravel/laravel",
    "description": "The Laravel Framework.",
    "keywords": [
        "framework",
        "laravel"
    ],
    "license": "MIT",
    "type": "project",
    "require": {
        "php": "^7.4",
        "artesaos/seotools": "^0.19",
        "auth0/login": "^6.4",
        "cnj/seotamic": "^2.0",
        "doctrine/dbal": "^2.9",
        "fideloper/proxy": "^4.0",
        "guzzlehttp/guzzle": "^7.0.1",
        "kanuu-io/kanuu-laravel": "^0.4.2",
        "laravel/cashier-paddle": "^1.4",
        "laravel/framework": "^8.35",
        "laravel/nova": "*",
        "laravel/scout": "^8.3",
        "laravel/tinker": "^2.0",
        "league/csv": "^9.1",
        "league/flysystem-aws-s3-v3": "^1.0",
        "league/flysystem-cached-adapter": "^1.0",
        "lob/lob-php": "^3.0",
        "meilisearch/meilisearch-laravel-scout": "^0.12.0",
        "php-ds/php-ds": "^1.2",
        "predis/predis": "^1.1",
        "rias/statamic-data-import": "^1.1",
        "sentry/sentry-laravel": "^2.4",
        "spatie/laravel-medialibrary": "^9.0.0",
        "spatie/laravel-responsecache": "^6.2",
        "spatie/laravel-sitemap": "5.8.*",
        "spatie/laravel-tags": "^3.1",
        "statamic/cms": "3.1.11"
    },
    "require-dev": {
        "barryvdh/laravel-debugbar": "^3.5",
        "facade/ignition": "^2.3.6",
        "fzaninotto/faker": "^1.9.2",
        "laravel/breeze": "^1.4",
        "laravel/dusk": "^6.18",
        "laravel/telescope": "^4.0",
        "mockery/mockery": "^1.4",
        "nunomaduro/collision": "^5.0",
        "phpunit/phpunit": "^9.3"
    },
    "autoload": {
        "classmap": [
            "database/seeds",
            "database/factories"
        ],
        "psr-4": {
            "App\\": "app/"
        },
        "files": [
            "bootstrap/helpers.php"
        ]
    },
    "autoload-dev": {
        "psr-4": {
            "Tests\\": "tests/"
        }
    },
    "extra": {
        "laravel": {
            "dont-discover": []
        }
    },
    "scripts": {
        "pre-update-cmd": [
            "Statamic\\Console\\Composer\\Scripts::preUpdateCmd"
        ],
        "post-root-package-install": [
            "@php -r \"file_exists('.env') || copy('.env.example', '.env');\""
        ],
        "post-create-project-cmd": [
            "@php artisan key:generate"
        ],
        "post-autoload-dump": [
            "Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",
            "@php artisan package:discover --ansi",
            "@php artisan statamic:install --ansi"
        ]
    },
    "config": {
        "preferred-install": "dist",
        "sort-packages": true,
        "optimize-autoloader": true,
        "platform": {
            "php": "7.4"
        },
    },
    "minimum-stability": "dev",
    "prefer-stable": true,
    "repositories": [
        {
            "type": "composer",
            "url": "https://nova.laravel.com"
        }
    ]
}
jasonvarga commented 2 years ago

It's been added to the default statamic/statamic starter kit so you won't see that on new sites.

On existing sites, you'll get that message once, hit yes, and it'll add it to your composer.json and never bother you again.

That's a new feature in Composer 2.2 where it wants you to confirm you trust composer plugins.

Statamic uses this plugin to download its compiled assets so it doesn't need to commit it all into the repo.