My composer file looks as follows:

    "name": "drupal/drupal",
    "description": "Drupal is an open source content management platform powering millions of websites and applications.",
    "type": "project",
    "license": "GPL-2.0+",
    "require": {
        "composer/installers": "^1.0.21",
        "wikimedia/composer-merge-plugin": "~1.3",
        "drupal/drupal-extension": "~3.0",
        "drupal/search_api": "1.x-dev",
        "drupal/search_api_view_modes": "1.x-dev",
        "drupal/paragraphs": "^1.0",
        "drupal/features": "3.x-dev",
        "drupal/robotstxt": "^1.0",
        "drupal/search_api_solr": "1.x-dev",
        "drupal/metatag": "1.x-dev",
        "drupal/pathauto": "1.x-dev",
        "drupal/acquia_connector": "^1.4",
        "drupal/sharethis": "2.x-dev",
        "drupal/field_group": "1.x-dev",
        "drupal/ckwordcount": "^1.0",
        "drupal/menu_link_attributes": "1.x-dev",
        "drupal/yaml_editor": "1.x-dev",
        "drupal/devel": "1.x-dev",
        "drupal/menu_block": "^1.4"
    "replace": {
        "drupal/core": "~8.2"
    "minimum-stability": "dev",
    "prefer-stable": true,
    "config": {
        "preferred-install": "dist",
        "autoloader-suffix": "Drupal8"
    "repositories": {
        "drupal": {
            "type": "composer",
            "url":  "https://packages.drupal.org/8"
    "extra": {
        "_readme": [
            "By default Drupal loads the autoloader from ./vendor/autoload.php.",
            "To change the autoloader you can edit ./autoload.php."
        "merge-plugin": {
            "include": [
            "recurse": false,
            "replace": false,
            "merge-extra": false
        "installer-paths": {
            "modules/contrib/{$name}": ["type:drupal-module"],
            "themes/contrib/{$name}": ["type:drupal-theme"]
    "autoload": {
        "psr-4": {
            "Drupal\\Core\\Composer\\": "core/lib/Drupal/Core/Composer"
    "scripts": {
        "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump",
        "post-autoload-dump": "Drupal\\Core\\Composer\\Composer::ensureHtaccess",
        "post-package-install": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup",
        "post-package-update": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup"

For all the modules that were downloaded as a 'dev' status, they appear to have been git cloned. Therefore, the changes aren't recognized or saved to my git tree, and don't push. These modules did not make it to my remote repository, and did not show up on the remote website.

I am not sure how this occurs, but for time being, I had to:

  • cd into module directory
  • rm -rf .git folder
  • git rm --cached modulename
  • git add modulename
  • git commit -m "Adding module"
  • git push

The module(s) then make it into my project repository and make it up to the remote server.

What is the correct workflow here? I am not running any build process or tool remotely but want to retain my project build with composer tracking the modules and themes I have installed.

1 Answer 1


Yes, that's what it does when you specify a dev version.

The recommended way to handle a composer project is to not commit composer managed code. all you commit is the composer.lock file and it is guaranteed that a composer install with install the exacty same versions, every time.

See https://getcomposer.org/doc/faqs/should-i-commit-the-dependencies-in-my-vendor-directory.md for more information on that and ways to work around it if you really want to.

Have a look at https://github.com/drupal-composer/drupal-project, it gives you a project environment that is preconfigured using the recommended git ignore settings and follows modern standard by keeping the vendor folder and other non-publich files out of the public web folder.

Update: One of the reasons why git does it, is that drupal.org AFAIK does not give you the possibly to download a specific dev snapshot, only the latest. And one of the main features of composer is to build the lock file and get the very same commit every time you run composer install, until you run composer update again.

  • Its tough because core update instructions say to replace the vendor folder and run composer update. If you don't use composer to install modules, then you will obliterate their composer deps, Search API with Solarium, for example.
    – Kevin
    Commented Oct 28, 2016 at 14:04
  • Ok, I just saw composer-patches. Now it is starting to make more sense, in regards to maintaining patches and changes.
    – Kevin
    Commented Oct 28, 2016 at 15:04
  • Just as an update - this problem is non-existent if you don't use the tarball from drupal.org and use a composer managed installation. There is also composerize-drupal too. It is beneficial to just sit down and create a deployment workflow around composer instead of commit all.
    – Kevin
    Commented Sep 12, 2018 at 14:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.