Composer & Continuous Integration

A lot of libraries currently use composer require --no-update, as described above, and then call composer install. This only has an effect because these libraries fail to provide a lock file, so that composer install actually has to run a full composer update which gives you no certainty about which versions get installed at all. </div> </div> Composer also offers a new `--prefer-lowest` option on `composer update` which will attempt to install the lowest version of all dependencies that still match all version constraints you have specified in your `composer.json`. This flag can be helpful in ensuring that your library actually works with all your minimum requirements. ## Improving Build Performance It is difficult to integrate continuous builds into your development process if the build process takes a long time and doesn't deliver direct feedback. Hence, the performance of individual builds is important to the successful use of CI. Fortunately, using the right options when running Composer can improve performance a lot. Apart from the advantages already discussed, installing dependencies from a lock file is significantly faster than running `composer update`. All package metadata is stored in the lock file itself, so `composer install` can immediately start downloading the actual dependencies instead of loading metadata and calculating dependency information. Composer keeps a local cache. The cache consists of two main components: copies of downloaded files which can be reused and avoid unnecessary waiting time while dependencies are downloaded. And copies of package metadata that needs to be loaded from repositories like Packagist to calculate dependencies. This cache needs to remain between builds to be effective. How sharing of data between builds can be accomplished depends on the tool you use to run your automated tests. On [Travis CI][6], a popular CI service for open source PHP libraries, you can [configure caching][4] to keep composer metadata. Another option is the [Vagrant Cachier][5] plugin, which can be used to share the Composer cache with your vagrant boxes, improving performance on reprovisioning. By default, composer runs in dev mode. Dev mode means that dependencies listed in `require-dev` will be installed, but it also means that Composer will prefer cloning repositories over downloading archives. This can be helpful during development to directly make and commit changes within your vendor directory. However, during testing you can use `--prefer-dist` to download package archives, which is usually faster than cloning entire repositories. You may prefer to use `--no-dev` for your automated tests to more closely match the production environment, but that would mean you cannot rely on testing tools to be installed from your `require-dev` dependency list. At the same time, `require-dev` packages do not influence the dependency resolution of packages in `require`. Even if you install `require-dev` packages in your test environment, all other dependencies will match the exact versions of your production environment. Lastly, the `--optimize-autoloader` option creates a faster version of the Composer autoloader, which takes longer to generate but results in faster class to file lookups. This option is always helpful in production environments, and may improve the overall performance of automated tests as well. ## Conclusion Continous Integration of projects using Composer can be improved through consistent use of a `composer.lock` file—even for libraries. Carefully reviewing the different options available for `composer install` allows you to speed up build times and provide developers with more direct feedback on builds. Additionally, you can use `composer require` to explicitly test various versions of dependencies without modifying the rest of your `composer.lock`. P.S. What did you think of this post? Got any questions or tips to share? Let us know by sharing a comment. [1]: http://en.wikipedia.org/wiki/Test-driven_development [2]: http://en.wikipedia.org/wiki/Behavior-driven_development [3]: https://blog.engineyard.com/2014/composer-its-all-about-the-lock-file [4]: http://docs.travis-ci.com/user/caching/ [5]: http://fgrehm.viewdocs.io/vagrant-cachier [6]: https://travis-ci.org/