How can I use Composer with no Internet access?

Question

I need to build and deploy a Drupal 8 site within an on-premise server with no internet access (developer machines have internet access, and access to a private repo).

I would like to avoid committing the whole vendor directory to the codebase, and use composer to build the site.

As far as I am aware, my options are:

1. Commit everything, including third-party modules and the vendor directory

2. Use something like Satis as a local repository and mirror all the necessary dependencies in there, and reference the private Composer repository

Any recommendations on this scenario?

Answer 1

I personnaly don't like to commit vendor dependencies. It makes the code review more complicated before a merge request cause the files you need to review are lost in the middle of an ocean of files you don't need to review.

In your case I would have a CI job which would be run on release branches and would exec composer install then generate a .tar.gz file containing all the files (including /vendor). That CI job would then push the .tar.gz on a repository manager like Nexus. And finally a deploy job in Jenkins would get the last hosted release on the repository manager, push it to the final host, untar it and run drush commands to update the site.

Answer 2

It's definitely a lot less work to commit everything. If you take that approach, you're basically already done.

Mirroring the dependencies sounds like a lot of work for little gain. If the concern is to minimize the repository size, you could make two repositories, one slimmed-down repository that just has composer and your custom code, and a second repository that includes all the builds with vendor and everything else. For an example of this approach, see the Terminus Build Tools plugin for Pantheon. This example is hosting-platform specific so it can't be used as-is, but may give you some ideas.