Composer is git cloning modules instead of download them?

Question

My composer file looks as follows:

{
    "name": "drupal/drupal",
    "description": "Drupal is an open source content management platform powering millions of websites and applications.",
    "type": "project",
    "license": "GPL-2.0+",
    "require": {
        "composer/installers": "^1.0.21",
        "wikimedia/composer-merge-plugin": "~1.3",
        "drupal/drupal-extension": "~3.0",
        "drupal/search_api": "1.x-dev",
        "drupal/search_api_view_modes": "1.x-dev",
        "drupal/paragraphs": "^1.0",
        "drupal/features": "3.x-dev",
        "drupal/robotstxt": "^1.0",
        "drupal/search_api_solr": "1.x-dev",
        "drupal/metatag": "1.x-dev",
        "drupal/pathauto": "1.x-dev",
        "drupal/acquia_connector": "^1.4",
        "drupal/sharethis": "2.x-dev",
        "drupal/field_group": "1.x-dev",
        "drupal/ckwordcount": "^1.0",
        "drupal/menu_link_attributes": "1.x-dev",
        "drupal/yaml_editor": "1.x-dev",
        "drupal/devel": "1.x-dev",
        "drupal/menu_block": "^1.4"
    },
    "replace": {
        "drupal/core": "~8.2"
    },
    "minimum-stability": "dev",
    "prefer-stable": true,
    "config": {
        "preferred-install": "dist",
        "autoloader-suffix": "Drupal8"
    },
    "repositories": {
        "drupal": {
            "type": "composer",
            "url":  "https://packages.drupal.org/8"
        }
    },
    "extra": {
        "_readme": [
            "By default Drupal loads the autoloader from ./vendor/autoload.php.",
            "To change the autoloader you can edit ./autoload.php."
        ],
        "merge-plugin": {
            "include": [
                "core/composer.json"
            ],
            "recurse": false,
            "replace": false,
            "merge-extra": false
        },
        "installer-paths": {
            "modules/contrib/{$name}": ["type:drupal-module"],
            "themes/contrib/{$name}": ["type:drupal-theme"]
        }
    },
    "autoload": {
        "psr-4": {
            "Drupal\\Core\\Composer\\": "core/lib/Drupal/Core/Composer"
        }
    },
    "scripts": {
        "pre-autoload-dump": "Drupal\\Core\\Composer\\Composer::preAutoloadDump",
        "post-autoload-dump": "Drupal\\Core\\Composer\\Composer::ensureHtaccess",
        "post-package-install": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup",
        "post-package-update": "Drupal\\Core\\Composer\\Composer::vendorTestCodeCleanup"
    }
}

For all the modules that were downloaded as a 'dev' status, they appear to have been git cloned. Therefore, the changes aren't recognized or saved to my git tree, and don't push. These modules did not make it to my remote repository, and did not show up on the remote website.

I am not sure how this occurs, but for time being, I had to:

• cd into module directory
• rm -rf .git folder
• git rm --cached modulename
• git add modulename
• git commit -m "Adding module"
• git push

The module(s) then make it into my project repository and make it up to the remote server.

What is the correct workflow here? I am not running any build process or tool remotely but want to retain my project build with composer tracking the modules and themes I have installed.

Answer 1

Yes, that's what it does when you specify a dev version.

The recommended way to handle a composer project is to not commit composer managed code. all you commit is the composer.lock file and it is guaranteed that a composer install with install the exacty same versions, every time.

See https://getcomposer.org/doc/faqs/should-i-commit-the-dependencies-in-my-vendor-directory.md for more information on that and ways to work around it if you really want to.

Have a look at https://github.com/drupal-composer/drupal-project, it gives you a project environment that is preconfigured using the recommended git ignore settings and follows modern standard by keeping the vendor folder and other non-publich files out of the public web folder.

Update: One of the reasons why git does it, is that drupal.org AFAIK does not give you the possibly to download a specific dev snapshot, only the latest. And one of the main features of composer is to build the lock file and get the very same commit every time you run composer install, until you run composer update again.