| 1 | --- |
| 2 | title: Composer |
| 3 | description: Install a workspace's PHP packages with Composer, straight from its repositories on g1t.sh. Push a tag and it is released. |
| 4 | --- |
| 5 | |
| 6 | Every workspace has a Composer repository of its own, made from its |
| 7 | repositories: one with a `composer.json` at its root is a package. There |
| 8 | is nothing to upload and nothing to keep in step. Push a tag and Composer |
| 9 | can install it; push to a branch and its `dev-` version follows. |
| 10 | |
| 11 | ```text |
| 12 | https://g1t.sh/-/composer/<workspace>/ |
| 13 | ``` |
| 14 | |
| 15 | Packages from Packagist still install from Packagist: add the workspace's |
| 16 | repository beside it, as [below](#install). |
| 17 | |
| 18 | ## Make a repository a package |
| 19 | |
| 20 | Give the repository a `composer.json` at its root with a `name`: |
| 21 | |
| 22 | ```json |
| 23 | { |
| 24 | "name": "acme/http-client", |
| 25 | "description": "Our HTTP client", |
| 26 | "type": "library", |
| 27 | "require": { "php": ">=8.1" }, |
| 28 | "autoload": { "psr-4": { "Acme\Http\\": "src/" } } |
| 29 | } |
| 30 | ``` |
| 31 | |
| 32 | Push it to the default branch, and the package appears in the workspace's |
| 33 | **Packages**, linked to the repository, with its README. Any vendor name |
| 34 | works; each name is one package in a workspace. |
| 35 | |
| 36 | ## Versions |
| 37 | |
| 38 | | In git | Version | |
| 39 | | --- | --- | |
| 40 | | A tag that reads as a version: `v1.2.0`, `1.2.0`, `2.0.0-RC1`, `1.0.0-beta.2` | That version (`v1.2.0`) | |
| 41 | | A branch | `dev-<branch>`; a branch named like a version, `1.x`, is `1.x-dev` | |
| 42 | | The default branch | Its `dev-` version, marked as the default branch | |
| 43 | |
| 44 | Each version's requirements, autoloading and the rest are read from the |
| 45 | `composer.json` at that tag or branch, so a version installs exactly what |
| 46 | it was tagged with. Tags that do not read as versions, such as `nightly`, |
| 47 | are left out. `extra.branch-alias` in the default branch's `composer.json` |
| 48 | aliases it as usual (`"dev-main": "1.x-dev"`). |
| 49 | |
| 50 | To release, tag and push: |
| 51 | |
| 52 | ```sh |
| 53 | git tag v1.3.0 |
| 54 | git push origin v1.3.0 |
| 55 | ``` |
| 56 | |
| 57 | Deleting a tag or branch takes its version away. |
| 58 | |
| 59 | ## Install |
| 60 | |
| 61 | Add the workspace's repository to your project, then require the package: |
| 62 | |
| 63 | ```sh |
| 64 | composer config repositories.acme composer https://g1t.sh/-/composer/acme/ |
| 65 | composer require acme/http-client |
| 66 | ``` |
| 67 | |
| 68 | Packages install from a zip of the tag's commit, made the first time |
| 69 | anyone asks for it and kept from then on. Files the repository's |
| 70 | `.gitattributes` marks `export-ignore`, such as tests, are left out of it, |
| 71 | as `git archive` leaves them out. `--prefer-source` clones from g1t.sh |
| 72 | instead. |
| 73 | |
| 74 | ## Private packages |
| 75 | |
| 76 | A package has its repository's visibility and |
| 77 | [roles](/guides/access-and-roles/): Read installs it. For a private one, |
| 78 | give Composer your username and an |
| 79 | [access token](https://g1t.sh/settings/tokens) (one with full access, or |
| 80 | with `packages:read` and `code:read`, so that `--prefer-source` can clone |
| 81 | too): |
| 82 | |
| 83 | ```sh |
| 84 | composer config --global --auth http-basic.g1t.sh <you> <token> |
| 85 | ``` |
| 86 | |
| 87 | That writes `~/.composer/auth.json`, which stays out of the project. A |
| 88 | `Bearer` token works as well (`bearer.g1t.sh`). Without credentials, a |
| 89 | workspace's repository lists only its public packages. |
| 90 | |
| 91 | ## In workflows |
| 92 | |
| 93 | A workflow's `G1T_TOKEN`, [the job's own token](/guides/actions/#the-jobs-token), can install the workspace's private |
| 94 | packages (its `packages: read` permission, in the default): |
| 95 | |
| 96 | ```yaml |
| 97 | jobs: |
| 98 | test: |
| 99 | runs-on: ubuntu-latest |
| 100 | steps: |
| 101 | - uses: actions/checkout@v4 |
| 102 | - run: composer config --global --auth http-basic.g1t.sh g1t "$G1T_TOKEN" |
| 103 | env: |
| 104 | G1T_TOKEN: ${{ secrets.G1T_TOKEN }} |
| 105 | - run: composer install --no-interaction |
| 106 | ``` |
| 107 | |
| 108 | ## Limits |
| 109 | |
| 110 | A zip is made of at most 10,000 files and 64 MB; a larger commit installs |
| 111 | from source (`composer install --prefer-source`). A package lists its |
| 112 | newest 300 version tags and 50 branches. Zips count toward the workspace's |
| 113 | package storage, as other packages do (see |
| 114 | [storage and pull limits](/guides/containers/#storage-and-pull-limits)). |