Alban Pommeret

Presentation of Composer, a dependency manager for PHP

1. Janvier 2015 COMPOSER Dependency manager for PHP Alban Pommeret /NEVERDANE LEAD DEV @REPUTATION VIP 1
2. Janvier 2015 WHAT IS COMPOSER ? HOW TO INSTALL IT? HOW TO USE IT? CREATE YOUR OWN PACKAGE MINIMUM STABILITY EXPLAINED SOME COOL STUFFS COMPOSER ASSETS INSTALLER 2
3. Janvier 2015 WHAT IS COMPOSER ? Composer is a package and dependency manager for PHP A PACKAGE MANAGER ? A package manager is a tool that automates the process of installing, upgrading, configuring, and removing packages for a software. The dependency layer resolves all dependencies automatically and recursively. It allows to resolve package installation per project. ‘‘ ‘‘ 3
4. Janvier 2015 OTHER KNOWN PACKAGE MANAGERS for NodeJs for Java for Red Hat for Web assets 4
5. Janvier 2015 COMPOSER IS WIDELY USED BY … EVERYONE for NodeJs for Java for Red Hat for Web assets 5
6. Janvier 2015 COMPOSER IS THE ENGINE, PACKAGIST IS THE REPOSITORY Composer Packagist Github Packagist doesn’t host the packages, it only creates a bridge to Github. 6
7. Janvier 2015 HOW TO INSTALL IT? Just download and execute the PHP installer: curl -s https://getcomposer.org/installer | php php composer.phar Then launch composer like this: Do move the phar to your bin directory: mv composer.phar /usr/local/bin/composer Composer is now accessible from everywhere: composer 7
8. Janvier 2015 HOW TO USE IT? Go to the root directory of your project and launch: composer init Then answer the following questions: We didn’t define the dependencies yet, we’ll do it later. 8
9. Janvier 2015 COMPOSER.JSON The previous steps created the following composer.json file: { "name": "root/app", "authors": [ { "name": "Alban Pommeret", "email": "ap@reputationvip.com" } ], "require": { } } Of course, You could generate this file manually. 9
10. Janvier 2015 HOW TO FIND A PACKAGE? Go to https://packagist.org For this example, we’ll search for the Twig template engine. 10
11. Janvier 2015 HOW TO CHOOSE THE VERSION? We want to use the last stable release. We ‘ll get the v1.16.3: 11
12. Janvier 2015 LET’S REQUIRE SOME DEPENDENCY Now add the line we get from Packagist to the require section of composer.json: "require": { "twig/twig": "1.16.3" } Now, run the following Composer’s command: composer install 12
13. Janvier 2015 WHAT JUST HAPPENED? Composer created a vendor directory and a composer.lock file. VENDOR DIRECTORY COMPOSER.LOCK FILE Contains all the packages you required in composer.json and their potential dependencies Keeps in memory the version of each package downloaded DO NOT COMMIT IT! COMMIT IT! 13
14. Janvier 2015 USE THE DOWNLOADED PACKAGE Composer comes with a great autoloader, Just add it to your PHP bootstrap file like this: require 'vendor/autoload.php'; This file handles a lazy loading of the packages PHP files. $loader = new Twig_Loader_Array(array( 'index.html' => 'Hello {{ name }}!', )); $twig = new Twig_Environment($loader); Twig is now accessible! 14
15. Janvier 2015 UPDATE A PACKAGE To use the last version of a package that satisfies your criteria, do as below: composer update vendorname/packagename This is useful only if you didn’t specified an exact version of a package in composer.json. Be aware that this command regenerates the composer.lock file. 15
16. Janvier 2015 WHAT’S THE POINT OF COMPOSER.LOCK? Whenever you install a new package or update old ones with composer, the composer.lock file is regenerated. This file is essential when you deploy your application in production. COMPOSER.LOCK FILE IT ENSURES THAT YOUR APPLICATION USES THE EXACT SAME VERSION OF THE PACKAGES THAN YOU DO. COMMIT IT! 16
17. Janvier 2015 UPDATE COMPOSER ITSELF Every month, Composer warns that we have to update it: Update it with: composer self-update 17
18. Janvier 2015 CREATE YOUR OWN PACKAGE You should always isolate every reusable component as a composer package. We will create a package for DataSailor: 1 ) Create a directory (data-sailor) for your reusable component data-sailor src 2 ) Create a src directory at its root where your source files will stand. 18
19. Janvier 2015 CREATE YOUR OWN PACKAGE (COMPOSER.JSON) Go to the root directory of your project and launch: composer init Then answer the following questions: 19
20. Janvier 2015 CREATE YOUR OWN PACKAGE (AUTOLOAD HANDLING) Add the following lines at the end of your composer.json file: "autoload": { "psr-4": { "ReputationVIP\\DataSailor\\": "src" } } This tells to Composer where to search for our package files when we require them. PSR-4 is a standard specification for autoloading classes from file paths. It is based on PHP namespaces and is the recommanded autoloading specification to use by Composer. 20
21. Janvier 2015 REQUIRE YOUR OWN PACKAGE IN A PROJECT The package we just created is private and not released on Packagist. We need to tell Composer where to find it. Add this to the composer.json of your project : Composer will know that this package should be downloaded from this repository and not from Packagist. "repositories": [ { "type": "git", "url": "git://url/data-sailor" } ], 21
22. Janvier 2015 REQUIRE YOUR OWN PACKAGE IN A PROJECT Now, add your composer package to your project’s dependencies: "dev-master" means that the last pushed version of the package on master will be used. "require": { "reputation-vip/data-sailor": "dev-master" } You just have to launch: composer install 22
23. Janvier 2015 TAG YOUR PACKAGE If you want to use two versions of a same package in different projects, you need to tag your package: We use Git tags for that: git tag -a -m "Your tag message" x.y.z Then push your tag: git push origin master --tags "require": { "reputation-vip/data-sailor": "x.y.z" } You can now use this tag in your project: 23
24. Janvier 2015 MINIMUM STABILITY EXPLAINED The minimum stability is an option filtering packages. The packages that doesn't match the minimum stability you defined will be ignored. You can specify it in composer.json: By default the minimum stability is stable. The minimum stability option is root-only. "minimum-stability": "RC" stable RC beta alpha dev 1.0.0 1.0.0-RC 1.0.0-beta 1.0.0-alpha dev-master HANDLED STABILITIES 24
25. Janvier 2015 ROOT-ONLY EXPLAINED Several options are tagged root-only in Composer’s documentation: This means that these options will not be overriden by required packages. YOUR PROJECT IS THE ROOT PACKAGE FOR COMPOSER. ROOT-ONLY OPTIONS SET THE CONTEXT YOU WANT TO WORK WITH. 25
26. Janvier 2015 MINIMUM STABILITY RESOLUTION minimum-stability is not defined in root. It is set to stable Package A is required as dev-master. But as it is explicitly defined in root, it is allowed to be used as dev stability. Package A requires Package B as dev-master. This dependency is not specified in root so the minimum stability will be used (stable). Package B will not be found! 26
27. Janvier 2015 @STABILITY FLAGS You could resolve the previous issue by defining the minimum stability globally: "minimum-stability": "dev" NOW, ALL YOUR PACKAGES COULD BE UNSTABLE! You should use the stability flags. They override the root’s minimum stability. Let’s grant Package B usage as dev: "require": { "A": "dev-master", (required in root, converted as dev-master@dev) "B": "@dev" (or "1.0.0@dev") } 27
28. Janvier 2015 COOL STUFFS Display the configuration Composer detected on your server: composer show –-platform (-p) Optimize your autoloader by generating class maps: composer install –-optimize (-o) Quickly fork a package: composer create-project doctrine/orm your_path 2.2.* Boost your download time by using cached packages: { "config": { "preferred-install": "dist" } } 28
29. Janvier 2015 HOW TO DEAL WITH CSS AND JAVASCRIPT? The assets files need to be accessible by the browser. However, Composer only downloads your PHP files into the vendor directory. "require": { "reputation-vip/composer-assets-installer": "~1.0" } A Composer plugin has been released for this: 29
30. Janvier 2015 HOW DOES IT WORK? Add the following lines at the end of your required package composer.json file: "extra": { "assets-dir" : "public" } This tells to Composer Assets Manager where is your public directory. Now, in your project composer.json, tell to composer where you want the assets to be downloaded: "extra": { "assets-dir" : "web" } On composer update, the assets will now be accessible through the following path: web/reputation-vip/data-sailor 30
31. Janvier 2015 QUESTIONS? 31 Alban Pommeret /NEVERDANE LEAD DEV @REPUTATION VIP