Composer: Effective Dependency Management for PHP Projects

Transcript

1. Composer: Effective Dependency Management for PHP Projects #BCSPHP Jeff Carouth

2. #bcsphp June 21, 2012 chris weldon jeff carouth & featuring

   sponsored by

3. http://mojolive.com/profile/jcarouth

4. Defining Composer Using composed projects Exposing tools through Composer Questions

   Agenda

5. Defining Composer Using composed projects Exposing tools through Composer Questions

   Agenda

6. http://getcomposer.org

7. Isn’t PEAR and the PEAR installer the de-facto PHP package

   manager?

8. Isn’t PEAR and the PEAR installer the de-facto PHP package

   manager? Yep.

9. However, PEAR tends to be used globally.* Composer is intended

   to be used in a per-project manner. * PEAR can be used per-project, but that’s not what this talk is about. Okay?

10. The Problem As a developer working on a PHP project,

    I want to use a consistent version of libraries and tools, so that the code will be stable and predictable.

11. Example: Behat

12. Example: Behat $ pear channel-discover pear.behat.org $ sudo pear install

    behat/behat $ sudo pear install behat/mink

13. Example: Behat $ pear channel-discover pear.behat.org $ sudo pear install

    behat/behat $ sudo pear install behat/mink $ behat --version Behat version 2.3.5

14. hack…hack…hack

15. What’s this? This awesome project I forked… uses Behat version

    2.4

16. Decision Time

17. Decision Time But WHY?

18. More Developers, More Dependency Problems

19. More Developers, More Dependency Problems Jeff PHPUnit 3.6.10 Behat 2.3.5

    Guzzle 2.0 Bob PHPUnit 3.4.15 Behat 2.2 Guzzle 1.1

20. More Developers, More Dependency Problems Jeff PHPUnit 3.6.10 Behat 2.3.5

    Guzzle 2.0 Bob PHPUnit 3.4.15 Behat 2.2 Guzzle 1.1 Of course, they were all installed via the PEAR installer

21. More Developers, More Dependency Problems Jeff PHPUnit 3.6.10 Behat 2.3.5

    Guzzle 2.0 Bob PHPUnit 3.4.15 Behat 2.2 Guzzle 1.1 Of course, they were all installed via the PEAR installer standardize & distribute

22. Common Solution $ cd ~/projects/my_awesome_project/vendor/ $ mkdir Behat && cd

    Behat $ wget https://github.com/downloads/Behat/Behat/behat.phar $ cd ../../ $ php vendor/Behat/behat.phar tests/features/

23. Common Solution $ cd ~/projects/my_awesome_project/vendor/ $ mkdir Behat && cd

    Behat $ wget https://github.com/downloads/Behat/Behat/behat.phar $ cd ../../ $ php vendor/Behat/behat.phar tests/features/ Or use a git submodule… or an SVN external if it’s still 2007

24. Common Solution $ cd ~/projects/my_awesome_project/vendor/ $ mkdir Behat && cd

    Behat $ wget https://github.com/downloads/Behat/Behat/behat.phar $ cd ../../ $ php vendor/Behat/behat.phar tests/features/ Or use a git submodule… or an SVN external if it’s still 2007 I kid. I kid.

25. Common Solution $ cd ~/projects/my_awesome_project/vendor/ $ mkdir Behat && cd

    Behat $ wget https://github.com/downloads/Behat/Behat/behat.phar $ cd ../../ $ php vendor/Behat/behat.phar tests/features/ Or use a git submodule… or an SVN external if it’s still 2007 BUT…we can do better I kid. I kid.

26. Install Composer

27. Install Composer with PEAR

28. with PEAR for MAXIMUM trolling Install Composer

29. with PEAR for MAXIMUM trolling Install Composer sorry, no can

    do

30. getcomposer.org

31. getcomposer.org local install $ curl -s http://getcomposer.org/installer | php $

    php composer.phar --version Composer version 6f576d4

32. getcomposer.org local install $ curl -s http://getcomposer.org/installer | php $

    php composer.phar --version Composer version 6f576d4 global install $ curl -s http://getcomposer.org/installer | php $ sudo mv composer.phar /usr/local/bin/composer $ composer --version Composer version 6f576d4

33. Now you can use Composer

34. $ cd ~/projects/composed-project $ vim composer.json

35. $ cd ~/projects/composed-project $ vim composer.json { "require": { "slim/slim":

    "1.6.3", "pimple/pimple": "1.0.0" } }

36. $ cd ~/projects/composed-project $ vim composer.json { "require": { "slim/slim":

    "1.6.3", "pimple/pimple": "1.0.0" } } $ composer install Installing dependencies - Installing slim/slim (1.6.3) Downloading: 100% - Installing pimple/pimple (1.0.0) Downloading: 100% Writing lock file Generating autoload files

37. $ cd ~/projects/composed-project $ vim composer.json { "require": { "slim/slim":

    "1.6.3", "pimple/pimple": "1.0.0" } } $ composer install Installing dependencies - Installing slim/slim (1.6.3) Downloading: 100% - Installing pimple/pimple (1.0.0) Downloading: 100% Writing lock file Generating autoload files

38. $ md public && vim public/index.php

39. $ md public && vim public/index.php 1 <?php 2 defined('BASEPATH')

    3 || define('BASEPATH', realpath(__DIR__."/../../")); 4 5 /** 6 * Configure autoloading from the composer library 7 */ 8 require_once BASEPATH . "/vendor/autoload.php"; 9 10 $app = new Slim(); 11 12 $app->get('/', function() { 13 print "Hello, world!"; 14 }); 15 16 $app->run();

40. 1 <?php 2 defined('BASEPATH') 3 || define('BASEPATH', realpath(__DIR__."/../../")); 4 5

    /** 6 * Configure autoloading from the composer library 7 */ 8 require_once BASEPATH . "/vendor/autoload.php"; 9 10 $app = new Slim(); 11 12 $app->get('/', function() { 13 print "Hello, world!"; 14 }); 15 16 $app->run(); $ md public && vim public/index.php

41. Commit You should commit your composer.json file, the generated composer.lock

    file, and ignore the vendor directory.

42. You should not ignore the [composer.lock] file in git. In

    fact you should commit it whenever it is changed. Users of your project or other developers can then run “composer install” to install exactly the versions you had in your lock file, rather than installing versions based on composer.json and potentially ending up with a slightly newer dependency which could result in problems, since you didn’t test with that particular version. - Nils Adermann

43. $ vim .gitignore vendor/ $ git add . $ git

    commit -m “Hello world! First commit” [master (root-commit) f38852e] Hello world! First commit 4 files changed, 44 insertions(+) create mode 100644 composer.json create mode 100644 composer.lock create mode 100644 public/index.php create mode 100644 .gitignore

44. A Contributor Appears Remember Bob? He’s going to contribute to

    this project. So he needs to make sure he gets the correct dependencies after he clones the project.

45. A Contributor Appears Remember Bob? He’s going to contribute to

    this project. So he needs to make sure he gets the correct dependencies after he clones the project.

46. A Contributor Appears Remember Bob? He’s going to contribute to

    this project. So he needs to make sure he gets the correct dependencies after he clones the project.

47. $ hub clone jcarouth/composer-example

48. $ hub clone jcarouth/composer-example $ [master ✓] composer install Installing

    dependencies from lock file - Installing pimple/pimple (1.0.0) Downloading: 100% - Installing slim/slim (1.6.3) Downloading: 100% Generating autoload files

49. $ hub clone jcarouth/composer-example $ [master ✓] composer install Installing

    dependencies from lock file - Installing pimple/pimple (1.0.0) Downloading: 100% - Installing slim/slim (1.6.3) Downloading: 100% Generating autoload files

50. $ hub clone jcarouth/composer-example $ [master ✓] composer install Installing

    dependencies from lock file - Installing pimple/pimple (1.0.0) Downloading: 100% - Installing slim/slim (1.6.3) Downloading: 100% Generating autoload files BOOM! That was easy

51. Dev-Specific Dependencies Behat for example. require-dev is the ticket.

52. $ vim composer.json 1 { 2 "require": { 3 "slim/slim":

    "1.6.3", 4 "pimple/pimple": "1.0.0" 5 }, 6 "require-dev": { 7 "behat/behat": "2.4.0" 8 }, 9 "config": { 10 "bin-dir": "bin" 11 } 12 } $ composer update Updating dependencies Nothing to install or update Writing lock file Generating autoload files

53. $ composer install --dev Installing dependencies from lock file Nothing

    to install or update Installing dev dependencies - Installing symfony/finder (dev-master) Cloning 9ee9a907afeef52956187e862714a7702ca26590 - Installing symfony/yaml (dev-master) Cloning 8272d98f8087878db37e8e5f6d4e37c5cc783dc3 ... snip --- - Installing behat/gherkin (v2.2.1) Downloading: 100% - Installing behat/behat (v2.4.0) Downloading: 100% ... suggestions ... Generating autoload files

54. Suggestions Suggested packages that can enhance or work well with

    this package. These are just informational and are displayed after the package is installed, to give your users a hint that they could add more packages, even though they are not strictly required. behat/behat suggests installing behat/mink-extension (for integration of with Mink) behat/behat suggests installing behat/yii-extension (for integration of with Yii framework) Generating autoload files

55. Finding Packages http://packagist.org Check other projects for a composer.json file.

56. None
57. None

58. http://packages.zendframework.com Making the component nature of the Zend Framework that

    much easier to use.

59. 1 { 2 "repositories": [ 3 { 4 "type": "composer",

    5 "url": "http://packages.zendframework.com/" 6 } 7 ], 8 "require": { 9 "slim/slim": "1.6.3", 10 "pimple/pimple": "1.0.0", 11 "zendframework/zend-validator": "2.0.*" 12 }, 13 "require-dev": { 14 "behat/behat": "2.4.0" 15 }, 16 "config": { 17 "bin-dir": "bin" 18 } 19 } Including the Zend\Validator component

60. $ composer update Updating dependencies - Installing zendframework/zend-validator (2.0.0-beta4) Downloading:

    100% zendframework/zend-validator suggests installing zendframework/ze… zendframework/zend-validator suggests installing zendframework/ze… zendframework/zend-validator suggests installing zendframework/ze… Writing lock file Generating autoload files

61. The End @jcarouth | carouth.com