Put composer.lock under version control

[sebastianbergmann]

This is not as simple as proposed in #5576 and also should to be done for the 8.5, 9.6, and 10.5 branches. At this point I do not expect another release from the 10.4 branch.

The PHAR build process for PHPUnit 8.5 and PHPUnit 9.6 performs composer require operations that, of course, modify the composer.json and composer.lock files. The build process needs to be adapter to also roll back the changes to composer.lock. (The composer.lock that is put into the PHAR for #5577 is the right one.)

• 8.5
• 9.6
• 10.5
• main

[sebastianbergmann]

This still needs to be backported to the 8.5 and the 9.6 branches.

[drupol]

Just excellent, thanks <3 !

[drupol]

I'm thinking about something to improve the CI and detect discrepancies between composer.json and composer.lock.

How about adding a step that does a composer validate --strict during the workflow?

[sebastianbergmann]

The build automation I use locally already has it (see https://github.com/sebastianbergmann/phpunit/blob/main/build.xml#L21). And yes, this will be added to GitHub Actions in due course.

[drupol]

Excellent! All good :) Looking forward for the next tag to provide it in Nix!

[sebastianbergmann]

Done :)

[bobthecow]

Hi @sebastianbergmann, I hope you don't mind me resurrecting an old issue.

I had similar thoughts to your initial response about including composer.lock in version control for PsySH. I ended up adding a lockfile to GitHub releases, but am running into issues because phar-specific dependencies and polyfills are added during the release build, so the lockfile can't be verified against the composer.json in the repo.

I'm curious why you changed your mind on including it in version control, and how you resolved your version of this issue?

The PHAR build process for PHPUnit 8.5 and PHPUnit 9.6 performs composer require operations that, of course, modify the composer.json and composer.lock files.

[sebastianbergmann]

The composer.lock that is used while building the PHAR is added to the PHAR and available for inspection through php phpunit.phar --composer-lock. For PHPUnit 8.5 and PHPUnit 9.6, this is the modified composer.lock.