Composer: Game Changing Dependency Management

Composer
Game Changing Dependency Management
php[architect] DevOps Summit Series Jeremy Kendall

I love to code
I’m terribly forgetful

I love to code
I take pictures

I love to code
I take pictures
I work at OpenSky

Adding Dependencies is Easy
‣ Copy and Paste

‣ Copy and Paste
‣ DIY Solution

‣ Copy and Paste
‣ DIY Solution
‣ SVN Externals

‣ Copy and Paste
‣ DIY Solution
‣ SVN Externals
‣ Git Submodules

What is Composer?
‣ Dependency management tool

What is Composer?
‣ Per-project

What is Composer?
‣ Per-project
‣ Inspired by:

What is Composer?
‣ Per-project
‣ Inspired by:
‣ node’s npm

What is Composer?
‣ Per-project
‣ Inspired by:
‣ node’s npm
‣ ruby’s bundler

Beneﬁts
‣ Easily declare project dependencies

Beneﬁts
‣ Updating dependency versions extremely simple

Beneﬁts
‣ Ensures your team is on the same page

Beneﬁts
‣ Ensures your team is on the same page
‣ Tons of excellent related features

Installing Locally
$ curl -sS https://getcomposer.org/installer | phpIn your project:

Installing Locally
$ curl -sS https://getcomposer.org/installer | php -- --install-dir=binSpecify a directory:

Installing Locally
$ curl -sS https://getcomposer.org/installer | php -- --install-dir=binSpecify a directory:
$ curl -sS https://getcomposer.org/installer | php
#!/usr/bin/env php
All settings correct for using Composer
Downloading...
Composer successfully installed to: /Users/jkendall/dev/
composer.phar
Use it: php composer.phar
What you’ll see:

Installing Globally
$ mv composer.phar /usr/local/bin/composer
Recommended

Installing Globally
$ mv composer.phar /usr/local/bin/composer
(You might need to use sudo)
Recommended

(There’s an installer for
Windows folks)

Keeping up to Date
$ composer self-update
You are using the latest composer version.
$ php composer.phar self-update
or

Keeping up to Date
$ composer self-update
(Always updates to the latest dev-master)
$ php composer.phar self-update
or

composer.json
{
"require": {
"monolog/monolog": "1.5.*"
}
}

composer.json
{
"require": {
}
}
‣Place in the root of your project

composer.json
{
"require": {
}
}
‣“require” speciﬁes package and version

composer.json
{
"require": {
}
}
‣monolog logging library

composer.json
{
"require": {
}
}
‣Version >= 1.5.0 and < 1.6

composer.json
{
"require": {
}
}
‣Version >= 1.5.0 and < 1.6
‣No fuss, no muss

‣ Exact version: 1.0.0, 12.2.4, etc.
Versions

‣ Wildcard: 3.*, 4.2.*
Versions

‣ Wildcard: 3.*, 4.2.*
‣ Range: >, >=, <=, !=
Versions

‣ Wildcard: 3.*, 4.2.*
‣ Range: >, >=, <=, !=
‣ Example: >=2.4
Versions

‣ Wildcard: 3.*, 4.2.*
‣ Range: >, >=, <=, !=
‣ Example: >=2.4
‣ Range: >=1.0,<1.7 (comma separated)
Versions

‣ Wildcard: 3.*, 4.2.*
‣ Range: >, >=, <=, !=
‣ Example: >=2.4
‣ Range: >=1.0,<1.7 (comma separated)
‣ Next Signiﬁcant Release: ~1.3.3
Versions

Installing Dependencies
$ composer install
Loading composer repositories with package information
Installing dependencies (including require-dev)
- Installing psr/log (1.0.0)
Loading from cache
- Installing monolog/monolog (1.5.0)
Loading from cache
monolog/monolog suggests installing mlehner/gelf-php (Allow sending log messages to a GrayLog2 server)
monolog/monolog suggests installing raven/raven (Allow sending log messages to a Sentry server)
monolog/monolog suggests installing doctrine/couchdb (Allow sending log messages to a CouchDB server)
monolog/monolog suggests installing ext-amqp (Allow sending log messages to an AMQP server (1.0+ required))
Writing lock file
Generating autoload files
composer install

composer.lock
‣ install writes a dependency lock ﬁle

composer.lock
‣ List of exact versions installed

composer.lock
‣ Commit both composer.lock and composer.json

composer.lock
‣ composer install now checks the lock ﬁle, not
composer.json

composer.lock
‣ composer install now checks the lock ﬁle, not
composer.json
‣ Update dependencies with composer update

Updating Dependencies
{
"require": {
"monolog/monolog": "1.6.*@dev"
}
}

{
"require": {
}
}
‣Updates monolog library version

{
"require": {
}
}
‣Updates monolog library version
‣Version >= 1.6.0 and < 1.7 (dev)

$ composer update
Updating dependencies (including require-dev)
- Removing monolog/monolog (1.5.0)
- Installing monolog/monolog (dev-master c933bb6)
Cloning c933bb67a8a2e45c42d0626a0cd6569789bf6ed7
Writing lock file
composer update

$ composer update
Writing lock file
‣Reads from composer.json
composer update

$ composer update
Writing lock file
‣Updates dependencies
composer update

$ composer update
Writing lock file
‣Updates dependencies
‣Rewrites lock ﬁle
composer update

Adding New Dependencies
Edit composer.json . . .
{
"require": {
"monolog/monolog": "1.6.*@dev",
"ircmaxell/password-compat": "1.0.3"
}
}

Adding New Dependencies
Or use the command line
$ composer require ircmaxell/password-compat:1.0.3
composer.json has been updated
- Installing ircmaxell/password-compat (1.0.3)
Downloading: 100%
Writing lock file
composer require

Autoloading
‣ Composer generates vendor/autoload.php

Autoloading
‣ Add require ‘vendor/autoload.php’;

Autoloading
‣ Add require ‘vendor/autoload.php’;
‣ Immediately begin using your dependencies

Autoloading
{
"require": {
},
"autoload": {
"psr-0": {
"Beeblebrox": "src/"
}
}
}
Don’t forget to add your own code!

Autoloading
$loader = require 'vendor/autoload.php';
$loader->add('AcmeTest', __DIR__);
Pro Tip
Grab an autoloader instance and
add more namespaces.

Kickstart a Project
$ composer create-project slim/slim-skeleton super-sweet-application
Installing slim/slim-skeleton (1.1.0)
- Installing slim/slim-skeleton (1.1.0)
Downloading: 100%
Created project in super-sweet-application
Installing dependencies (including require-dev)
- Installing slim/slim (2.3.0)
Downloading: 100%
- Installing slim/extras (2.0.3)
Loading from cache
- Installing twig/twig (v1.13.1)
Loading from cache
Writing lock file
composer create-project

Libraries
‣ Everyone has written a library of some sort

Libraries
‣ Making up examples is not my strong suit

Libraries
‣ Let’s walk through a real library . . .

Libraries
‣ Let’s walk through a real library . . .
‣ . . . and check out some awesome Composer features

PHP Domain Parser
https://github.com/jeremykendall/php-domain-parser

{
"name": "jeremykendall/php-domain-parser",
"description": "Public Suffix List based URL parsing implemented in PHP.",
"license": "MIT",
"authors": [
{
"name": "Jeremy Kendall",
"homepage": "http://about.me/jeremykendall",
"role": "Developer"
}
],
"bin": ["bin/pdp-psl"],
"keywords": ["Public Suffix List", "domain parsing", "url parsing"],
"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
"mikey179/vfsStream": "1.1.*",
"jeremykendall/phpctagger": "0.0.*"
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
"post-install-cmd": [
"PhpCtaggerComposerScriptCtagger::ctag"
],
"post-update-cmd": [
]
}
}

{
"license": "MIT",
"authors": [
{
"role": "Developer"
}
],
"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
],
]
}
}
Package requirements

{
"license": "MIT",
"authors": [
{
"role": "Developer"
}
],
"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
],
]
}
}
Package requirements
Autoloading

{
"license": "MIT",
"authors": [
{
"role": "Developer"
}
],
"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
],
]
}
}
Add the “name” key
and it’s installable

{
"license": "MIT",
"authors": [
{
"role": "Developer"
}
],
"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
],
]
}
}
Additional
metadata

{
"license": "MIT",
"authors": [
{
"role": "Developer"
}
],
"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
],
]
}
}
Don’t forget the license!

{
"license": "MIT",
"authors": [
{
"role": "Developer"
}
],
"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
],
]
}
}
Full ﬂedged library!

Now for the cool(er)
stuff . . .

{
"license": "MIT",
"authors": [
{
"role": "Developer"
}
],
"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
],
]
}
}
require-dev

require-dev
‣ Lists packages required for development (think tests)

require-dev
‣ Only applies to the root package

require-dev
‣ Both install and update install require-dev by default

require-dev
‣ Both install and update install require-dev by default
‣ (Use the --no-dev ﬂag to skip installing dev
dependencies)

{
"license": "MIT",
"authors": [
{
"role": "Developer"
}
],
"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
],
]
}
}
bin

bin
‣ cli scripts to pass along to package users

bin
‣ A set of ﬁles that should be treated as binaries

bin
‣ Installs binaries to vendor/bin for any project that
depends on your project

bin
‣ Installs binaries to vendor/bin for any project that
depends on your project
‣ php-domain-parser uses a bin to update the local copy
of the public sufﬁx list

{
"license": "MIT",
"authors": [
{
"role": "Developer"
}
],
"require": {
"php": ">=5.3.0",
"ext-curl": "*"
},
"require-dev": {
},
"autoload": {
"psr-0":
{
"Pdp": "library/"
}
},
"scripts": {
],
]
}
}
scripts

scripts
‣ Used to execute custom code during the Composer
execution process

scripts
execution process
‣ PHP callback (deﬁned as a static method) . . .

scripts
execution process
‣ . . . or any command-line executable command

scripts
execution process
‣ Only scripts deﬁned in the root composer.json are
executed

scripts
execution process
‣ Only scripts deﬁned in the root composer.json are
executed
‣ If a script is deﬁned in a dependency, you can use it in
your composer.json

scripts
‣ Composer ﬁres “named events” during execution

scripts
‣ Named events include:

scripts
‣ pre- and post-install-cmd

scripts
‣ pre- and post-update-cmd

scripts
‣ post-root-package-install

scripts
‣ post-root-package-install
‣ Many more . . .

Running scripts
Execute Composer (script will execute if the named
event is triggered) or . . .

Running scripts
Execute Composer (script will execute if the named
event is triggered) or . . .
composer run-script <named event>

Example
public static function create(Event $event)
{
$dir = dirname($event->getComposer()->getConfig()->get('vendor-dir'));
$io = $event->getIO();
$io->write('Reviewing your Flaming Archer environment . . .', true);
$configExists = file_exists($dir . '/config.php');
$configDistExists = file_exists($dir . '/config-dist.php');
if (!$configExists && $configDistExists) {
$io->write('Creating config.php by copying config-dist.php . . .', true);
copy($dir . '/config-dist.php', $dir . '/config.php');
$io->write("Done! Please edit config.php.", true);
} else {
$io->write('Found config.php.', true);
}
}
https://github.com/jeremykendall/ﬂaming-archer/blob/develop/library/Fa/Composer/Script/Conﬁg.php

You’ve built your library.
Now what?

Push it to aVCS
‣ git, svn, or hg all work equally well

Push it to aVCS
‣ For the sake of simplicity I’ll assume git/github

Push it to aVCS
‣ Package versions:

Push it to aVCS
‣ Tags are package versions (1.0.0, v2.5.4, etc)

Push it to aVCS
‣ Branches are dev versions (dev-{branchname},
{branchname}-dev)

Push it to aVCS
‣ Branches are dev versions (dev-{branchname},
{branchname}-dev)
‣ For this reason, I strongly recommend using semantic
versioning: http://semver.org

Packagist
‣ The main package repository for Composer

Packagist
‣ (Aside: Search Packagist before “rolling your own”)

Packagist
‣ Packages published there need no special settings in
composer.json to be installable (see “repositories” key)

Packagist
‣ Submitting is dead simple

Packagist
‣ Submitting is dead simple
‣ Create account, hit big green submit button

But what about internal
proprietary packages?

Satis to the Rescue
‣ Static composer repository generator

Satis to the Rescue
‣ Lightweight, static ﬁle based version of Packagist

Satis to the Rescue
‣ Simple to conﬁgure

Satis to the Rescue
‣ Simple to conﬁgure
‣ Flexible

$ composer create-project composer/satis --stability=dev --keep-vcs
Installing composer/satis (dev-master 059588ef0fd0977964ad13637e02012519686202)
- Installing composer/satis (dev-master master)
Cloning master
Created project in /Users/jkendall/dev/satis
Installing dependencies (including require-dev) from lock file
Warning: The lock file is not up to date with the latest changes in composer.json . . .
- Installing symfony/process (dev-master 75c8101)
Cloning 75c810176f8e069714cef8696d7ecc3aa86e8168
- [ . . . ]
- Installing twig/twig (v1.13.1)
Loading from cache
symfony/console suggests installing symfony/event-dispatcher ()
composer create-project composer/satis --stability=dev --keep-vcs

Satis conﬁg.json
{
"name": "Satis Demo",
"homepage": "http://satis.dev",
"repositories": [
{ "type": "vcs", "url": "https://github.com/jeremykendall/php-domain-parser" },
{ "type": "vcs", "url": "https://github.com/jeremykendall/phpctagger" }
],
"require": {
"jeremykendall/php-domain-parser": ">=0.0.5",
"jeremykendall/phpctagger": ">0.0.6"
},
"archive": {
"directory": "dist",
"format": "tar"
}
}

Build Repo
$ php bin/satis build config.json web/

composer.json
{
"repositories": [
{ "type": "composer", "url": "http://satis.dev" }
],
"require": {
"jeremykendall/php-domain-parser": "0.0.7"
}
}

Satis Demo Project
‣ Want to goof around with Satis?

Satis Demo Project
‣ See: https://github.com/jeremykendall/satis-demo

Satis Demo Project
‣ Clone, follow instructions in README, and WIN

Satis Demo Project
‣ Clone, follow instructions in README, and WIN
‣ Satis really is dead simple to set up

composer install --no-dev --prefer-dist --optimize-autoloader

“example/package”: “2.3.x-dev#5aec89a”

Non-Composer and PEAR packages can be installed
(see “repositories” key documentation)

http://getcomposer.org
#composer on irc.freenode.org

Credits
‣ Thanks to php[architect] for having me
IMMA LET YOU FINISH,
BUT RAFAEL DOHMS
HAS THE BEST
COMPOSER TALK OF
ALL TIME.

Credits
‣ Thanks to Rafael Dohms, the Composer presenter

Credits

Credits
‣ Thanks to Jordi Boggiano, Nils Adermann, and the
community for an amazing project (and all the
documentation I cribbed from)

Credits
‣ Thanks to our sponsors for help making this happen

Credits
‣ Thanks to our sponsors for help making this happen
‣ Thanks to all of you for being here

Thanks!
jeremy@jeremykendall.net
http://about.me/jeremykendall
@jeremykendall
https://joind.in/8968

Composer: Game Changing Dependency Management

Recommandé

Recommandé

Contenu connexe

Plus de Jeremy Kendall

Plus de Jeremy Kendall (12)

Dernier

Dernier (20)

Composer: Game Changing Dependency Management