TYPO3 + Composer + Deployment

Question

I thought when migrating projects to composer, one big benefit would be to have a small project repository left where alle the composer managed stuff (TYPO3 sources + public extensions) could be excluded from VCS. On deployment, a „composer install“ on live system would always lead to the desired state without risk.

But official TYPO3 documentation says:

You should not run composer on your live webspace. You should always run composer on your local or a dedicated deployment machine, so you can test if everything worked fine. After running your tests, you can deploy the vendor and public folder to your web server.

I cannot follow why. Because this leads to each projects repository needs to contain the whole TYPO3 sources in the projects VCS, although they might be excluded there. What are the reasons for this approach and what are the risks with „my“ approach?

EDIT: Of course i ment to specify exact version numbers until revision level for composer packages. Doing so, would there still be any risks with my approach?

Answer 1

composer can be used in multiple ways and I wonder, too, why the TYPO3 docs show such a strong opinion here (without reasons?).

It refers to this model:

• Local development system with composer for changing composer.json/composer.lock

• Build environment/CD pipeline runs composer install --no-dev and just copies the ready-built filesystem to the staging/live system

• Live server without composer integrates with user data (database & /fileadmin)

This is preferred by some (me included) because it facilitates a testing step in a reproducible (build) environment. It also works well if the build step consists of more than composer (eg asset building).

While only for composer it wouldn't make a big difference if it would have to be installed on live (+ its dependencies), the more build steps you have the more "development" software you would have to put on live. And that's probably where some drew a line and decided development -> build -> live is a much more powerful model.

While the build environment could very well be on the live server, I wouldn't want it to be in a published state ( I don't know if you refered to that). So I would do at least some copying around (or rather symlink switching) in order to make sure that problems during build/testing do not affect the published site.

Other models work, too.

Answer 2

When you use the composer to fetch the sources for your TYPO3 environment by composer install , then you do not know exactly which version of which TYPO3 extension you will get. The composer.json files define a range of allowed version numbers, and not an exact version number. When you have a local or deployment environment, then the composer installation will give you a state extension 1 in version 1, extension 2 in version 2. Then you test everything. After 2 weeks you decide, that everything is ok. But if you would use composer after 2 weeks on your live system, it could happen that extension 1 is now in version 2 which has a severe error. Then a composer run would bring you this buggy version 2 of extension 1. This is not what you wanted.

A workaround exists.

How to install a specific version of package using Composer?