Managing Dependencies with Composer (Madison PHP October 2013)

Does your project rely on third-party code? Does your company share code between multiple projects? If so, you have dealt with dependencies. Traditionally, there have been many ways to manage dependencies for PHP projects: PEAR, copying and pasting, ZIP archives, Subversion exports, Git submodules, or complicated build scripts. Composer, a dependency manager for PHP, aims to make the whole process more streamlined. Learn how Composer can be used to manage third-party packages, how to create and distribute your own Composer packages, and how Composer can change the way you think about code reuse.

Transcript

1. Managing Dependencies with Composer Madison PHP October 17th, 2013
2. @beausimensen  simensen  beau.io  Beau Simensen
3. dflydev 
6. Dependency Manager for PHP
7. Dependencies Are External Requirements
8. Traditionally, Managing Dependencies Has Not Been Trivial
9. { “name”: “acme/my-project”, “description”: “Acme’s My Project”, “license”: “MIT”, “require”: { “silex/silex”: “1.1.*” }, “autoload”: { “psr-0”: { “Acme\\MyProject\\”: “src” } } }
10. Autoloading Versioning Packaging
11. Autoloading Versioning Packaging
12. // // life without autoloading // require “../vendor/whizbang/classes.php”; $service = new Acme\WhizBang\Thing()
13. // // life WITH autoloading // $service = new Acme\WhizBang\Thing()
14. // // Example autoloader that will load any fully qualified // class name in the Foo\Bar namespace. If someone tries // to load Foo\Bar\Baz, this autoloader will attempt to // include a file named src/Baz.php which is expected to // define Foo\Bar\Baz. // spl_autoload_register(function ($fqcn) { $prefix = 'Foo\\Bar\\'; $class = ltrim($class, '\\'); if (strncmp($prefix, $class, strlen($prefix)) === 0) { $relative = substr($class, strlen($prefix)); $file = __DIR__ . '/src/' . str_replace('\\', '/', $relative) . '.php'; if (is_readable($file)) { include $file; } } });
15. // // life when everyone has their own custom // autoloader bootstrap, registration classes // and manually configuring class loaders // require “../vendor/whizbang/bootstrap.php”; require “../vendor/awesomesoft/bootstrap.php”; require “../vendor/lessawesome/bootstrapper.php”; require “../vendor/ultraframework/classloader.php”; LessAwesome\BootStrapper::register(); UltraFramework\ClassLoader::register(array( “\\Acme\\MyApp\\” = “../src” ));
16. Composer Provides a Configurable Autoloader
17. Each Package Can Configure Its Own Autoloader Rules
18. require “vendor/autoload.php”;
19. Autoloading Versioning Packaging
20. Semantic Versioning http://semver.org/
21. MAJOR.MINOR.PATCH Which number do you increment and why?
22. MAJOR.MINOR.PATCH When you make API incompatible changes
23. MAJOR.MINOR.PATCH When you add backwards-compatible functionality
24. MAJOR.MINOR.PATCH When you make backwards-compatible bug fixes
25. Pre-Release Identifiers (Composer “Stability”) •1.0.0-alpha •1.0.0-beta.1 •1.0.0-RC2 •1.0.0 (stable)
26. Exact Versions 1.0.2
27. Ranges >=1.0,<2.0
28. Wildcards 1.0.*
29. Next Significant Release Tilde Operator
30. Next Significant Release ~1.2 >=1.2,<2.0
31. Next Significant Release ~1.2.3 >=1.2.3,<1.3
32. Let’s You Know What You Are Getting Into
33. Safe 1.3.* Only get bug fixes.
34. Reasonably Safe 1.* Get bug fixes and new features.
35. Crazy Sauce * Composer allows this, but don’t. Just don’t.
36. Other Version Schemes Can Be Used But don’t expect Composer to read your mind and do anything smart with them.
37. Autoloading Versioning Packaging
38. Any VCS Repository Can Be Treated like a Composer Package
39. Composer Treats Tags as Versions for VCS Repositories
40. Composer Treats Branches as @dev for VCS Repositories
41. GitHub and BitBucket Serve Tags as Archives
42. silex-1.0.1.tar.gz
43. • Integration into existing VCS workflow • Packaging is as simple as tagging and pushing • Hosting can be handled automatically by GitHub and BitBucket VCS Repository Benefits
44. • It is best to rely on version detection using tags and branches • There is a version key but do not use it • Composer skips branches and tags that do not have composer.json so you won’t magically get legacy versions VCS Repository Gotchas
45. https://packagist.org
46. Over 17,000 Packages
48. Basic Usage Managing dependencies for a project.
49. Install Composer http://getcomposer.org/download
50. $ curl -sS https://getcomposer.org/installer | php $ php composer.phar --version
51. $ chmod 755 composer.phar $ mv composer.phar ~/bin/composer $ composer --version
52. $ composer diag Check for common errors.
53. composer.json
54. { “name”: “acme/my-project”, “description”: “Acme’s My Project”, “license”: “MIT”, “require”: { “silex/silex”: “1.1.*” }, “autoload”: { “psr-0”: { “Acme\\MyProject\\”: “src” } } }
55. { “name”: “acme/my-project”, “description”: “Acme’s My Project”, “license”: “MIT”, “require”: { “silex/silex”: “1.1.*” }, “autoload”: { “psr-0”: { “Acme\\MyProject\\”: “src” } } }
56. vendor-name/project-name
57. { “name”: “acme/my-project”, “description”: “Acme’s My Project”, “license”: “MIT”, “require”: { “silex/silex”: “1.1.*” }, “autoload”: { “psr-0”: { “Acme\\MyProject\\”: “src” } } }
58. { “name”: “acme/my-project”, “description”: “Acme’s My Project”, “license”: “MIT”, “require”: { “silex/silex”: “1.1.*” }, “autoload”: { “psr-0”: { “Acme\\MyProject\\”: “src” } } }
59. $ composer validate Checks composer.json for errors.
60. Autoload Configuration
61. PSR-0 PHP Framework Interoperability Group http://php-fig.com
62. PSR-0’s Big Ideas • 1:1 mapping between fully qualified class names and the filesystem (one file / class) • Embrace namespaces • Support some legacy naming conventions
63. { “autoload”: { “psr-0”: { “Acme\\MyProject\\”: “src” } } }
64. { “autoload”: { “psr-0”: { “Acme\\MyProject\\”: “src” } } } $bar = new Acme\MyProject\Foo\Bar();
65. { “autoload”: { “psr-0”: { “Acme\\MyProject\\”: “src” } } } $bar = new Acme\MyProject\Foo\Bar(); src/Acme/MyProject/Foo/Bar.php
66. PSR-4 PHP Framework Interoperability Group (Coming Soon!) http://php-fig.com
67. PSR-4’s Big Ideas • 1:1 mapping between a part of fully qualified class names and the filesystem (one file / class) • Minimize the number of extra directories that PSR-0 required • Drop support for legacy naming conventions that PSR-0 supported
68. { “autoload”: { “psr-4”: { “Acme\\MyProject\\”: “src” } } }
69. { “autoload”: { “psr-4”: { “Acme\\MyProject\\”: “src” } } } $bar = new Acme\MyProject\Foo\Bar();
70. { “autoload”: { “psr-4”: { “Acme\\MyProject\\”: “src” } } } $bar = new Acme\MyProject\Foo\Bar(); src/Foo/Bar.php
71. // // Example autoloader that will load any fully qualified // class name in the Foo\Bar namespace. If someone tries // to load Foo\Bar\Baz, this autoloader will attempt to // include a file named src/Baz.php which is expected to // define Foo\Bar\Baz. // // This is PSR-4 in a nutshell. // spl_autoload_register(function ($fqcn) { $prefix = 'Foo\\Bar\\'; $class = ltrim($class, '\\'); if (strncmp($prefix, $class, strlen($prefix)) === 0) { $relative = substr($class, strlen($prefix)); $file = __DIR__ . '/src/' . str_replace('\\', '/', $relative) . '.php'; if (is_readable($file)) { include $file; } } });
72. Files Explicitly include certain files
73. { “autoload”: { “files”: [ “src/foo.class.php”, “src/bar.class.php” ] } }
74. { “autoload”: { “files”: [“src/functions.php”] } }
75. { “autoload”: { “files”: [“src/autoload.php”] } }
76. Classmap Generates a single key => value map classes found by scanning for .php and .inc files in specified directories
77. { “autoload”: { “classmap”: [ “src/includes/”, “resources/config.php” ] } }
78. composer.lock
79. $ composer install If composer.lock does not exist, it installs from composer.json and creates composer.lock. If composer.lock exists, it installs from there.
80. $ composer update Installs dependencies from composer.json and creates or updates composer.lock.
81. Stability
82. { “require”: { “silex/silex”: “~1.1@dev”, “symfony/http-foundation”: “@beta” } }
83. Stability Comes From Root Package
84. { “require”: { “silex/silex”: “~1.1@dev”, “symfony/http-foundation”: “@beta” }, “minimum-stability”: “alpha” }
85. Library Project Usage Maintaining a reusable Composer package.
86. Version Constraint Considerations
87. If the dependency specifications are too tight, you are in danger of version lock (the inability to upgrade a package without having to release new versions of every dependent package). — Semantic Versioning http://semver.org/
88. If dependencies are specified too loosely, you will inevitably be bitten by version promiscuity (assuming compatibility with more future versions than is reasonable). — Semantic Versioning http://semver.org/
89. { “require”: { “dflydev/doctrine-orm-service-provider”: “1.0.*”, “silex/silex”: “1.1.*”, “pimple/pimple”: “1.1.*”, “doctrine/orm”: “2.4.*” } } { “name”: “silex/silex”, “require”: { “pimple/pimple”: “1.*” } } { “name”: “dflydev/doctrine-orm-service-provider”, “require”: { “pimple/pimple”: “1.*”, “doctrine/orm”: “~2.3” } }
90. Branch Stability dev-master and @dev
91. { “require”: { “silex/silex”: “1.1@dev”, “pimple/pimple”: “dev-master” } }
92. Branch Versions Composer automatically detects numbered branches as development versions. Branch named 2.0 is treated as 2.0.*@dev
93. Branch Aliases Composer can alias a named branch to a specific development version. Branch named master is treated as 2.0.*@dev
94. { “extra”: { “branch-alias”: { “dev-master”: “2.0.x-dev” } } }
95. When starting a new library that is to be distributed via Packagist / Composer, be SURE to set up your dev-master branch alias. — Don Gilbert https://twitter.com/dilbert4life/status/380137097614458881
96. Dev Dependencies
97. { “require-dev”: { “phpunit/phpunit”: “3.7.*”, “acme/specialized”: “1.*” } }
98. Solver
99. Solver A C B I H 1.* ~2.3 D F E G 1.* 1.4.* >=2.3.5 J K 1.4.10
100. Questions? #composer #sculpin #silex-php #dflydev @beausimensen  Want These Slides? http://goo.gl/eleP4U https://speakerdeck.com/simensen