How to Add Private Github Repository as Composer Dependency

How to add private github repository as Composer dependency

Work with private repositories at GitHub and BitBucket:

JSON

{
    "require": {
        "vendor/my-private-repo": "dev-master"
    },
    "repositories": [
        {
            "type": "vcs",
            "url":  "git@bitbucket.org:vendor/my-private-repo.git"
        }
    ]
}

The only requirement is the installation of SSH keys for a git client.

Docs

Load composer dependencies of private git repository

package type is for non-composer dependencies. If you use this type, Composer will not even look for composer.json file inside of defined package source, you need to include all required information about package inside of the package declaration in your project composer.json:

"repositories": [
    {
        "type": "package",
        "package": {
            "name": "{vendor}/{package-name}",
            "description": "{removed}",
            "type": "library",
            "require": {
                "illuminate/database": "^5.6",
                "chumper/zipper": "1.0.x",
                "symfony/debug": "^4.0",
                "vlucas/phpdotenv": "^2.4"
            },
            "version": "{arbitrary-version}",
            "source": {
                "url": "git@github.com:{github-username}/{github-repository}.git",
                "type": "git",
            }
        }
    }
]

But in your case (you have a package with proper composer.json) you should use vcs type:

"repositories": [
    {
        "type": "git",
        "url": "git@github.com:{github-username}/{github-repository}.git"
    }
]

How to add a new non-git private package/classes to a PHP application?

Currently it's still not possible to create a composer package from a repository subfolder/ (Github Issue)

You can follow this Packagist link to create your own package.

Define Your Package

Put a file named composer.json at the root of your package's repository, containing this information:

{
    "name": "your-vendor-name/package-name",
    "description": "A short description of what your package does",
    "require": {
        "php": "^7.2",
        "another-vendor/package": "1.*"
    }
}

This is the strictly minimal information you have to give.

For more details about package naming and the fields you can use to document your package better, see the about page.

Commit The File

Add the composer.json to your git or other VCS repository and commit it.

Publish It

Login or register on (the) site, then hit the submit button in the menu.

[...]

How to invoke composer create-project on a private repo?

From the Parse error it looks like your double quotes are not escaped properly. Try running the command like this.

composer create-project vendor/package new-project --repository "{\"type\": \"vcs\", \"url\": \"https://github.com/vendor/package\"}" --stability=dev

Composer multi-level dependency with private repos

There is no better solution for you.

You have to provide the meta data of every repository hosting a package somehow. Composer can find out about the public packages because it knows how to ask packagist.org. For private repos this cannot be done, so someone has to give Composer a pointer where to get the meta data instead.

There are basically two ways: The one you don't want to use is to use an additional instance doing the same thing Packagist does, by either running your own instance of Packagist, or Satis, or Toran Proxy.

The other way is to list each repository individually in ALL composer.json files that would ever need the package hosted there. This clearly is the inferior solution because it means that you constantly have to add ALL repositories you have into ALL repositories' composer.json file, just in case any cross referenced dependencies occur. Additionally it probably slows things down because of the number of server connections involved when collecting the newest data during an update.

There is no silver bullet for you. Composer decided to not scan repositories recursively in order to be able to have acceptable run times. Only the root repository decides where to scan for packages, with using only Packagist being the default (which can be turned off), and additionally scanning either packagist-like instances, or repos.

Satis is still the easiest way to host private repos because it only requires running PHP on the command line, and then make the created files available via static HTTP hosting.

Packagist is a PHP application with dependencies to a database, redis, a cache, a mail server etc. - likely more complicated to set up than Satis.

Toran Proxy also is a PHP application, but without such dependencies (according to the website - I have no experience using it). You'd only need a vhost able to run the main script.

For all of them, you'd have to get the configuration right, add the list of your private repositories for them to scan, and then add the URL of your new Composer information source to all composer.json files in all your private repositories - but this has to be done only one final time, after that this URL stays the same and points to updated meta data of all your repos.

How to use a specific tag/version with composer and a private git repository?

How to require a specific Git tag?

Change the version requirement to dev-master, followed by a hash # and the Git tag name, e.g. v0.5.0, like so:

"require": {
    "vendor/package": "dev-master#v0.5.0"
}

How to require a specific Git commit?

Change the version requirement to dev-master, followed by a hash # and the Git commit reference, e.g. dd6ed3c8, like so:

"require": {
    "vendor/package": "dev-master#dd6ed3c8"
}

Referencing: https://getcomposer.org/doc/04-schema.md#package-links

---

Define your own package and set version and reference

An alternative to working with repositories of "type": "vcs" is to define a custom package "type": "package" inside repositories and work with a reference.

The reference is either a Git commit hash, or a tag or branch name, like origin/master.

This will tie the version to a specific commit reference, in this case dd6ed3c8.

"repositories": [
  # ...
  {
    "type": "package",
    "package": {
      "name": "vendor/package",
      "version": "v0.5.0",
      "source": {
        "url": "git@gitlab.server.com:vendor/project.git",
        "type": "git",
        "reference": "dd6ed3c8"
      }
    }
  }
]

How to make composer recognize particular github vendor namespace in general instead of specifying each repository from the same vendor separately

You can't do this, unfortunatelly.

One solution would be to use Private Packagist, or to boot up your own instance of packagist.org site which is open source: https://github.com/composer/packagist, which would then host your own private packages.

---

Related Topics