October: Add composer support to the marketplace

[LukeTowers]

It would be great to add composer support to the marketplace so that it could make all marketplace plugins available through a composer interface. There are resources out there for how to create your own packagist clones (composer repositories), and we could have the project IDs provided to composer through an environment variable so that we could even make private plugins available through a composer interface.

[immersiontravis]

I would love this. We're trying to get away from Wordpress, and we're thinking about adopting October instead. But one of the reasons we dislike Wordpress is its habit of self-updating plugins – which brings the site's filesystem out of sync with version control. I've been disappointed to learn that October repeats Wordpress' mistakes in this area.

Composer support for all Marketplace plugins would go a long way toward solving this.

[w20k]

Hi,

I might be wrong, but if you don't want to have any updates, just disable them, and use composer as your source of updates. OctoberCMS won't update anything, if you don't press "the" button ;)

From the config, to disable core updates: config/cms -> 'disableCoreUpdates' => false,.
And from the Plugins menu:

[ghost]

I like this idea very much! Would it also be a good idea to force people to also use composer.lock file and have those plugin packages scanned with https://snyk.io/ thus making OctoberCMS Marketplace safer!

[LukeTowers]

@ayumihamsaki neat idea, unfortunately Snyk doesn't support composer / PHP yet: https://support.snyk.io/getting-started/languages-support

[ghost]

@LukeTowers Daftspunk is using it with his plugins, see here: https://snyk.io/vuln/SNYK-PHP-RAINLABUSERPLUGIN-72142

[LukeTowers]

No clue how I missed that @ayumihamsaki, good catch!

[github-actions[bot]]

This issue will be closed and archived in 3 days, as there has been no activity in the last 30 days. If this issue is still relevant or you would like to see action on it, please respond and we will get the ball rolling.

[github-actions[bot]]

This issue will be closed and archived in 3 days, as there has been no activity in the last 60 days.
If this issue is still relevant or you would like to see it actioned, please respond and we will re-open this issue.
If this issue is critical to your business, consider joining the Premium Support Program where a Service Level Agreement is offered.

[LukeTowers]

With composer 2.0 supporting filtered repositories (see https://php.watch/articles/composer-2), any plugins / themes provided by the marketplace acting as a composer provider should be namespaced under october-plugin/author-plugin and october-theme/author-theme, and then the composer files returned by the packages should take advantage of the custom installer name property to be sure that they are installed in the correct location instead of /plugins/october-plugin/author-plugin