run-script uses libraries bundled in composer.phar instead of versions specified by project

[ramsey]

I've discovered, if developing any Composer scripts, when running composer run-script [script-name], those scripts will use libraries bundled in composer.phar instead of the vendor directory. This means you might get out-of-date libraries and unexpected errors.

I have a full, working example available at https://github.com/ramsey/composer-scripts-issue.

I have also posted my scripts below, using your template.

---

My composer.json:

{
    "require": {
        "symfony/finder": "^5.0"
    },
    "require-dev": {
        "composer/composer": "^1.10"
    },
    "autoload": {
        "psr-4": {
            "Foo\\": "."
        }
    },
    "scripts": {
        "foo": "Foo\\Foo::run"
    }
}

Output of composer diagnose:

Checking composer.json: WARNING
No license specified, it is recommended to do so. For closed-source software you may use "proprietary" as license.
Checking platform settings: OK
Checking git settings: OK
Checking http connectivity to packagist: OK
Checking https connectivity to packagist: OK
Checking github.com rate limit: OK
Checking disk free space: OK
Checking pubkeys:
Tags Public Key Fingerprint: 57815BA2 7E54DC31 7ECC7CC5 573090D0  87719BA6 8F3BB723 4E5D42D0 84A14642
Dev Public Key Fingerprint: 4AC45767 E5EC2265 2F0C1167 CBBB8A2B  0C708369 153E328C AD90147D AFE50952
OK
Checking composer version: OK
Composer version: 1.10.6
PHP version: 7.4.5
PHP binary path: /usr/local/Cellar/php/7.4.5_2/bin/php
OpenSSL version: OpenSSL 1.1.1g  21 Apr 2020

When I run this command:

./composer.phar run-script foo

I get the following output:

> Foo\Foo::run
PHP Fatal error:  Uncaught Error: Call to undefined method Symfony\Component\Finder\Finder::ignoreVCSIgnored() in /.../composer-scripts-issue/Foo.php:17
Stack trace:
#0 phar:///.../composer-scripts-issue/composer.phar/src/Composer/EventDispatcher/EventDispatcher.php(305): Foo\Foo::run(Object(Composer\Script\Event))
#1 phar:///.../composer-scripts-issue/composer.phar/src/Composer/EventDispatcher/EventDispatcher.php(209): Composer\EventDispatcher\EventDispatcher->executeEventPhpScript('Foo\\Foo', 'run', Object(Composer\Script\Event))
#2 phar:///.../composer-scripts-issue/composer.phar/src/Composer/EventDispatcher/EventDispatcher.php(96): Composer\EventDispatcher\EventDispatcher->doDispatch(Object(Composer\Script\Event))
#3 phar:///.../composer-scripts-issue/composer.phar/src/Composer/Command/RunScriptCommand.php(106): Composer\EventDispatcher\EventDispatcher->dispatchScript('foo', true, Array)
#4 phar:///.../composer-scripts-issue/composer.phar/vendor/symfony/cons in /.../composer-scripts-issue/Foo.php on line 17

Fatal error: Uncaught Error: Call to undefined method Symfony\Component\Finder\Finder::ignoreVCSIgnored() in /.../composer-scripts-issue/Foo.php:17
Stack trace:
#0 phar:///.../composer-scripts-issue/composer.phar/src/Composer/EventDispatcher/EventDispatcher.php(305): Foo\Foo::run(Object(Composer\Script\Event))
#1 phar:///.../composer-scripts-issue/composer.phar/src/Composer/EventDispatcher/EventDispatcher.php(209): Composer\EventDispatcher\EventDispatcher->executeEventPhpScript('Foo\\Foo', 'run', Object(Composer\Script\Event))
#2 phar:///.../composer-scripts-issue/composer.phar/src/Composer/EventDispatcher/EventDispatcher.php(96): Composer\EventDispatcher\EventDispatcher->doDispatch(Object(Composer\Script\Event))
#3 phar:///.../composer-scripts-issue/composer.phar/src/Composer/Command/RunScriptCommand.php(106): Composer\EventDispatcher\EventDispatcher->dispatchScript('foo', true, Array)
#4 phar:///.../composer-scripts-issue/composer.phar/vendor/symfony/cons in /.../composer-scripts-issue/Foo.php on line 17

And I expected this to happen:

> Foo\Foo::run
README.md
.gitignore
Foo.php
composer.json

Foo.php contains:

<?php

declare(strict_types=1);

namespace Foo;

use Composer\Script\Event;
use Symfony\Component\Finder\Finder;

class Foo
{
    public static function run(Event $event): void
    {
        $finder = new Finder();
        $finder
            ->ignoreDotFiles(false)
            ->ignoreVCSIgnored(true)
            ->in(__DIR__);

        foreach ($finder as $file) {
            $event->getIO()->write($file->getFilename(), true);
        }
    }
}

I have a .gitignore in the same directory that contains:

composer.lock
composer.phar
vendor/

[ramsey]

If running composer from ./vendor/bin/composer, the script executes as
expected:

$ ./vendor/bin/composer run-script foo
> Foo\Foo::run
README.md
.gitignore
Foo.php
composer.json

[Seldaek]

This is a known issue and one of the reasons we try to keep our dependency count very low.. It is also a reason that Composer scripts should keep their dependencies low.

IMO it is not fixable. Fixing it would require that we take composer requirements into account when installing the project dependencies, as otherwise we could not with certainty run with the project autoloader. And that would just be crazy as for most projects this conflict is not a problem at all.

It should be mitigated to some extent post-2.0 once we can bump our php requirement and thus also bump our bundled dependencies to latest versions. Right now we bundle symfony 2.8 packages as that is the only way to support php 5.3 in the phar. That's unfortunately very much outdated.

[ramsey]

Is there a way to have scripts opt to run in a separate process and load the local project's autoloader?

[Seldaek]

No there isn't a way to do that sorry.

[celorodovalho]

So, no solution so far so this issue and that's it?