Composer, git and update core and modules

Question

I started working with Drupal 8 and tried to find out the best way for developing and administrating projects. As Drupal 8 with all its dependencies is very big (more than 60 MB) I like the suggestion not to commit all the Drupal core, modules and dependencies into a git repository but to let Composer deal these things. The idea is to set everything (Drupal core version, installed modules with their versions) in the composer.json, commit this file to a GIT repository and when a remote colleague wants to work on the project he/she just checks out the composer.json from the repo locally, starts composer install and all the needed PHP files (Drupal core, modules and dependencies) get downloaded (as far as I understand).

For me this seems to be an interesting way to start new projects but I feel that this could be some kind of bottleneck for the everyday project management. For example when I define the modules and the core in composer.json usually it seems to be done in a more general way in terms of the version. Usually not the specific version seems to be defined in composer.json:

"drupal/core": "8.0.*"

When I start composer install locally earlier as my colleague he/she might get a newer version of Drupal which may lead to different behaviors of our working copies (although it should not with regards to versioning rules - I know). But if we define a specific version:

"drupal/core": "8.0.0"

so we can be sure that every remote colleague will have the exact same version we can not use composer update to update to newer versions automatically - we would need to look for the latest version and change the version in composer.json manually.

The same appears with contributed modules or themes.

To be honest, I never worked with Composer before; maybe someone with more composer experience could explain to me how to deal with these issues.

Answer 1

Is it correct that "composer install" does install the versions as defined in composer.lock which gets created after "composer install" is run the first time?

The composer.json file describes which versions can be installed, while the composer.lock module contains the version of the installed libraries.

For example, the composer.json file could contain the following, which would say that is only acceptable to install any version that is greater or equal to 1.0 but lower than 1.1.

"require": {
    "monolog/monolog": "1.0.*"
}

The composer.lock file could contain a "monolog/monolog": "1.0.2" line, since that is the higher version available of the Monolog library that respect the restrictions of the composer.json file.

So, simplifying:

• The composer.json file is used from composer install
• Both the composer.json and the composer.lock files are used from composer update

When I start composer install locally earlier as my colleague he/she might get a newer version of Drupal which may lead to different behaviors of our working copies (although it should not with regards to versioning rules - I know).

Yes, that can happen, but it is not a problem, since you just need to run composer update to get the same versions your colleague has. That is, if both of you have the same composer.json file, and neither of you installed other libraries that could cause any conflict.