Subversion in combination with composer dependencies

Question

I want to manage my project with subversion and the project requires dependencies managed by composer.

What is the best practice doing that?

I can add my composer.json with the required dependencies to my trunk. Then I run a composer update in my working copy. As far as I know i should exclude the folders created by composer from my trunk because they don't need to be copied into the repos. Is this correct?

If i do another checkout i have to do a composer update again. Is this correct?

And if i do an export i have to do another composer update.

The main question is: Is it possible to handle the composer dependencies like svn:externals? If i do a checkout or a export subversion should download the dependencies by itself. Is that possible? Additional i want to be able to do a composer update later by hand.

Sorry but i am a little bit confused about the integration of composer into a subversion repository. Maybe anyone is able to explain it.

Answer 1

You commit both the composer.json and the composer.lock of your project into your repository and exclude the vendor folder from being committed - after you ran composer update once.

After that, you only ever run composer install to install exactly the dependencies you got when last running update:

• Checkout fresh from SVN -> composer install
• Grab an update from SVN -> composer install

The only situation where you run composer update is when you WANT to update your dependencies.

And one note regarding svn:externals: While in theory these are capable of doing the same as Composer, ie "hardcoding" (in a way) the exact revision of some other repository you are using in your current repository, this is rarely ever used. Usually you point your svn:externals to the trunk branch. But this is a risk: If you go back to an earlier revision, you won't get that earlier version of your dependency! You could include the revision being used externally into the svn:externals link, but I found this to be rather cumbersome to manage the last time I used SVN (way before Composer was started). I wouldn't recommend using these if you can use Composer instead. Also note that most Composer packages are hosted on Git based repository platforms like Github or Bitbucket, so there would be no way to include them as svn:externals anyway.