chore: don't ship composer.lock in the starter - #9
Open
vipertecpro wants to merge 1 commit into
Open
Conversation
vipertecpro
marked this pull request as ready for review
August 2, 2026 05:22
simonhamp
reviewed
Aug 2, 2026
vipertecpro
force-pushed
the
fix/composer-install-out-of-box
branch
from
August 2, 2026 05:31
5f047d9 to
f75053c
Compare
vipertecpro
changed the title
composer install work out of the box on a fresh clonecomposer install needs no auth
Remove the committed composer.lock so a fresh clone resolves dependencies from their current sources instead of a pinned (and now stale) lock file. This matches the skeleton convention (laravel/laravel ships no lock) and fixes a fresh 'composer install' prompting for auth on nativephp/mobile-ui, which is now published on public Packagist. The nativephp-plugins repository block stays in place for premium plugins; the lock becomes the derived project's responsibility. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
vipertecpro
force-pushed
the
fix/composer-install-out-of-box
branch
from
August 2, 2026 05:55
f75053c to
924fcdb
Compare
vipertecpro
changed the title
composer install needs no auth
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Remove the committed
composer.lockfrom the starter so a fresh clone installs cleanly:Why
composer installreads download URLs straight fromcomposer.lock, and the committed lock pinnednativephp/mobile-uito the private plugins registry — so a fresh clone without registry credentials hit an auth prompt on the very first install.Rather than keep regenerating a pinned lock, this follows the standard skeleton convention (e.g.
laravel/laravelships nocomposer.lock): a starter is a template, so each new project should resolve its dependencies fresh from their current sources at creation time.mobile-uiis now on public Packagist, so a fresh resolve pulls it (and everything else) with no auth. The lock then becomes the derived project's responsibility, which is where it belongs.Change
composer.lock.composer.jsonis untouched — thenativephp-pluginsrepository block stays in place for premium plugins.Verified
Fresh clone with no credentials configured →
composer installresolves and installs cleanly,mobile-uipulled from public GitHub.🤖 Generated with Claude Code