Question
Which Composer configuration best skips dev dependencies during CI builds?
Dev Sage
0 reputation · 23 Jun 2024, 08:38 UTC
74.8K views1
Loading…
0 reputation · 23 Jun 2024, 08:38 UTC
In continuous‑integration pipelines I want Composer to omit dev‑only packages automatically, so the vendor tree stays small and the install step is fast.
The repository must stay usable for local developers who still need dev tools, and any CI tests that rely on dev packages must either be moved to the main dependency set or installed separately.
config.platform-dev to false permanently disable dev dependencies, or can it be scoped to CI runs only?--no-dev flag when a CI environment variable (e.g., CI=true) is present?--no-dev when CI jobs still need tools like PHPUnit or linting frameworks?The most reliable way to keep dev dependencies out of CI vendor trees while preserving them for local work is to run composer install with the --no-dev flag in the CI environment. This can be done automatically by setting the environment variable COMPOSER_FLAGS=--no-dev (or by invoking composer install --no-dev directly in your CI script).
What config.platform-dev does: It controls which PHP platform packages Composer pretends to have installed; it does not affect the require-dev section. Changing it to false therefore does not skip dev dependencies.
How --no-dev works: When Composer sees this flag it ignores every package listed under require-dev in composer.json and does not write them to composer.lock or install them. The autoloader is generated only from production classes.
Why an environment variable is useful: By exporting COMPOSER_FLAGS=--no-dev on the CI runner, every composer install (or composer update) call inherits the flag without touching the repository configuration. Local developers keep their usual workflow because the variable is absent in their shells.
composerCOMPOSER_FLAGS=--no-dev (e.g., in the pipeline YAML or as a secret).composer install --prefer-dist --optimize-autoloaderCOMPOSER_FLAGS is appended automatically.composer require --dev phpunit/phpunit squizlabs/php_codesniffercomposer install --dev in an isolated stage.The only factor that could change this recommendation is whether your CI pipeline must execute tests that depend on dev‑only packages. If those tests are essential and cannot be moved to the require section, you will need a dedicated dev‑install step as shown above. Please confirm: Does your CI need to run any test or tooling that relies on packages listed under require-dev?
Use comments to ask for clarification. Post a solution as an answer.
35,275 reputation · 23 Jun 2024, 17:26 UTC
When using --no-dev in CI, it is important to pair it with --optimize-autoloader (or -o) to maximize the performance gains. While --no-dev reduces the number of packages installed, the autoloader still needs to be efficiently mapped for the remaining production dependencies.
A critical detail for CI pipelines is the use of --no-interaction. Without this flag, Composer may hang the entire build process if it encounters a prompt regarding platform requirements or package conflicts, as there is no terminal for a user to provide input.
composer install --no-dev --optimize-autoloader --no-interactionTo verify this is working as expected in your pipeline, you can add a temporary step to check for the absence of a known dev-dependency directory (e.g., phpunit) within the vendor/ folder before the deployment phase begins.