Add composer.lock to version control

This will allow more control over the dependencies and will be easier to
investigate issues from past commits as the dependencies will be locked.

Signed-off-by: Maurício Meneghini Fauth <mauricio@fauth.dev>

.github/workflows/daily-snapshots.yml

@@ -52,8 +52,6 @@ jobs:
 
       - name: Install Composer dependencies
         uses: ramsey/composer-install@v2
-        with:
-          dependency-versions: highest
 
       - name: Install Yarn modules
         run: yarn install --non-interactive

.github/workflows/lint-and-analyse-php.yml

@@ -34,7 +34,6 @@ jobs:
         if: always()
         uses: ramsey/composer-install@v2
         with:
-          dependency-versions: highest
           # Ignore zip for php-webdriver/webdriver
           composer-options: "--ignore-platform-req=ext-zip"
 
@@ -78,8 +77,6 @@ jobs:
 
       - name: Install Composer dependencies
         uses: ramsey/composer-install@v2
-        with:
-          dependency-versions: highest
 
       - name: Analyse files with PHPStan
         run: composer phpstan -- --memory-limit 2G

.github/workflows/mutation-tests.yml

@@ -59,8 +59,6 @@ jobs:
 
       - name: Install Composer dependencies
         uses: ramsey/composer-install@v2
-        with:
-          dependency-versions: highest
 
       - name: Run Infection for changed files only
         if: github.event_name == 'push' || github.event_name == 'pull_request'

.github/workflows/other-tools.yml

@@ -50,8 +50,6 @@ jobs:
 
       - name: Install Composer dependencies
         uses: ramsey/composer-install@v2
-        with:
-          dependency-versions: highest
 
       - name: Set up Node
         uses: actions/setup-node@v3

.github/workflows/test-selenium.yml

@@ -102,8 +102,6 @@ jobs:
 
       - name: Install Composer dependencies
         uses: ramsey/composer-install@v2
-        with:
-          dependency-versions: highest
 
       - name: Set up Node
         uses: actions/setup-node@v3

.github/workflows/tests.yml

@@ -46,7 +46,7 @@ jobs:
           musl-locales musl-locales-lang \
           gettext composer git && \
           composer config version "$(php -r "define('VERSION_SUFFIX', ''); require_once('src/Version.php'); echo \PhpMyAdmin\Version::VERSION;")" && \
-          composer update && \
+          composer install && \
           ./scripts/generate-mo && \
           php\$V -d memory_limit=512M ./vendor/bin/phpunit --no-logging --no-coverage --testsuite unit --exclude-group=%s" \
           "${{ matrix.php-version }}" "${{ matrix.exclude-phpunit-groups }}" > ./do-tests.sh
@@ -61,19 +61,19 @@ jobs:
         run: docker run -v $PWD:/app --workdir /app --rm ${{ matrix.arch }}/alpine:3.17 sh /app/do-tests.sh
 
   test-php:
-    name: Test on PHP ${{ matrix.php-version }} and ${{ matrix.os }}
+    name: Test on PHP ${{ matrix.php-version }}, ${{ matrix.composer-dependency }} and ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
-    continue-on-error: ${{ matrix.experimental }}
+    continue-on-error: ${{ matrix.php-version == '8.4' }}
     strategy:
       matrix:
         php-version: ['8.1', '8.2', '8.3']
-        experimental: [false]
         os: [ubuntu-latest]
+        composer-dependency: [locked, highest]
         php-extensions: ['mbstring, iconv, mysqli, zip, gd, bz2']
         include:
           - php-version: '8.4'
-            experimental: true
             os: ubuntu-latest
+            composer-dependency: locked
             composer-options: '--ignore-platform-req=php+'
             php-extensions: 'mbstring, iconv, mysqli, zip, bz2'
     steps:
@@ -99,7 +99,7 @@ jobs:
       - name: Install Composer dependencies
         uses: ramsey/composer-install@v2
         with:
-          dependency-versions: highest
+          dependency-versions: ${{ matrix.composer-dependency }}
           composer-options: ${{ matrix.composer-options }}
 
       - name: Run PHP tests
@@ -158,8 +158,6 @@ jobs:
 
       - name: Install Composer dependencies
         uses: ramsey/composer-install@v2
-        with:
-          dependency-versions: highest
 
       - name: Run PHP tests
         run: composer run phpunit -- --testsuite unit

.github/workflows/update-po.yml

@@ -35,8 +35,6 @@ jobs:
 
       - name: Install Composer dependencies
         uses: ramsey/composer-install@v2
-        with:
-          dependency-versions: highest
 
       - name: Set up git config
         run: |

.gitignore

@@ -54,7 +54,6 @@ phpunit.xml
 # Ant cache
 cache.properties
 # Composer
-composer.lock
 /vendor/
 # NPM
 /node_modules/

composer.json

@@ -152,6 +152,9 @@
             "dealerdirect/phpcodesniffer-composer-installer": true,
             "phpstan/extension-installer": true,
             "composer/package-versions-deprecated": true
+        },
+        "platform": {
+            "php": "8.1.99"
         }
     }
 }

doc/setup.rst

@@ -104,14 +104,14 @@ Additionally you need to install dependencies using `Composer <https://getcompos
 
 .. code-block:: sh
 
-    composer update
+    composer install
 
 If you do not intend to develop, you can skip the installation of developer tools
 by invoking:
 
 .. code-block:: sh
 
-    composer update --no-dev
+    composer install --no-dev
 
 Finally, you'll need to use `Yarn`_ to install some JavaScript dependencies:
 

scripts/create-release.sh

@@ -495,18 +495,11 @@ rm README.rst
 
 if [ -f ./scripts/console ]; then
     # Update the vendors to have the dev vendors
-    composer update --no-interaction
+    composer install --no-interaction
     # Warm up the routing cache for 5.1+ releases
     ./scripts/console cache:warmup --routing
 fi
 
-PHP_REQ=$(sed -n '/"php"/ s/.*"\^\([0-9]\.[0-9]\.[0-9]\|[0-9]\.[0-9]\).*/\1/p' composer.json)
-
-if [ -z "$PHP_REQ" ] ; then
-    echo "Failed to figure out required PHP version from composer.json"
-    exit 2
-fi
-
 echo "* Writing the version to composer.json (version: $version)"
 composer config version "$version"
 
@@ -516,8 +509,7 @@ composer config version "$version"
 cp composer.json composer.json.backup
 COMPOSER_VERSION="$(composer --version)"
 echo "* Running composer (version: $COMPOSER_VERSION)"
-composer config platform.php "$PHP_REQ"
-composer update --no-interaction --no-dev
+composer install --no-interaction --no-dev
 
 # Parse the required versions from composer.json
 PACKAGES_VERSIONS=''
@@ -531,7 +523,7 @@ done
 
 echo "* Installing composer packages '$PACKAGES_VERSIONS'"
 
-composer require --no-interaction --update-no-dev $PACKAGES_VERSIONS
+composer require --no-interaction $PACKAGES_VERSIONS
 
 echo "* Running a security checkup"
 security_checkup
@@ -551,11 +543,6 @@ autoload_checkup
 
 echo "* Running a security checkup"
 security_checkup
-if [ $do_tag -eq 1 ] ; then
-    echo "* Commiting composer.lock"
-    git add --force composer.lock
-    git commit -s -m "Adding composer lock for $version"
-fi
 
 if [ -f package.json ] ; then
     echo "* Running Yarn"
@@ -724,15 +711,6 @@ if [ $do_tag -eq 1 ] ; then
     echo "* Tagging release as $tagname"
     git tag -s -a -m "Released $version" $tagname $branch
     echo "   Dont forget to push tags using: git push --tags"
-    echo "* Cleanup of $branch"
-    # Remove composer.lock, but we need to create fresh worktree for that
-    git worktree add --force $workdir $branch
-    cd $workdir
-    git rm --force composer.lock
-    git commit -s -m "Removing composer.lock"
-    cd ../..
-    rm -r $workdir
-    git worktree prune
 fi
 
 # Mark as stable release