Do you have to run Composer on localhost and on production?

Question

I\'m new to Composer (getcomposer.org) and wasn\'t sure how it works if I install a package locally using Composer and then push my codebase to my production server using Gi

Answer 1

It depends how are you working. If you, like getcomposer.org says, are ignoring the "vendor" folder then you need to run it again. If you are versioning the "vendor" folder then you don't need to run it again.

Have in mind that composer will get in charge of managing your dependencies versions, so there is no need to put your dependencies files under versioning. If you put these files under git you will only make your repository bigger.

Read https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies.

For clarification when you ignore the "vendor" folder Git don't track the files under the folder so if you clone the repo it will be like composer never was executed

Answer 2

When you setup your project, you add your dependencies into your composer.json file in your local project directory.

Once you have done this, you will need to run composer update. You can also run composer install, however, without a composer.lock file, composer install actually runs composer update.

Composer update goes out and resolves all the dependencies of all the libraries you are using, downloads them to the /vendor directory, creates an autoloader script and generates the composer.lock file.

For your project what you want to do is version your composer.json AND your composer.lock file.

On your production server, you will always run composer install, which insures that the libraries on your production server are the exact same ones you utilized in your development process.

composer install is also a lot faster as it does not have to do all the dependency management work, and can almost always just pull a specific commit#. It doesn't have to look at version strings. Thus is is usually very fast, once a server has already gone through it once.

In development the only time you should run composer update, is when you introduce a new library OR you have an issue where an underlying library has been changed and you know that you need to have composer go out and re-calculate the dependencies. composer update always recalculates and downloads the latest revisions of any library available even if the version level did not change. This means that there is a potential for something to have become broken, necessitating the potential for as full a set of regression tests as you might have available. In short, something having nothing to do with what you're actually changing could have broken, so you only want to introduce the potential for change when you are forced to.

Of course, if you did introduce a new library, you have no choice but to run composer update.

Once you run composer update, your composer.lock file will be updated (as expected) and the production server will pick this up when you run composer install on it.

As others stated, put the vendors in your gitignore. The point is that these are external libraries that you depend on, but that do not belong in your project, and should not be versioned. In the old days some people utilized git submodules, and it's a big PITA you really want to avoid, not to mention that submodules don't address dependencies of the libraries you included.