Add support for Symfony Flex

[Kocal]

Hello,

Since Symfony Flex & Symfony recipes, we have a file symfony.lock which is updated whenever a Symfony-related package is updated.

That would be awesome to commit this file aswell with composer.json and composer.lock, thanks 🙂

---

• https://twitter.com/Kocal_/status/1027211130203238400

[greysteil]

Just digging into this. I'm having a hard time getting the symfony.lock file to update when I can the requirements in the composer.json file and call composer update. Am I missing something, or is symfony/flex still a bit rough around the edges?

[greysteil]

My composer file is:

{
    "type": "project",
    "license": "proprietary",
    "require": {
        "symfony/flex": "^1.0",
        "beelab/tag-bundle": "v1.1.0"
    }
}

Calling composer install with that generates me a symfony.lock, but then when I update the requirement on beelab/tag-bundle to v1.3.0 and call composer update I get an updated composer.lock but no change to the symfony.lock.

[greysteil]

PR with the beginnings of the work on this is here. My PHP tests are failing locally, but I think it's due to the composer version on my machine being out of date.

Next step is to add a test, likely using the dummy composer file above.

[Kocal]

I had "phpoffice/phpspreadsheet": "^1.2" in my composer.json.

This package has been updated from 1.3.1 to 1.4.0 by dependabot (only composer.lock has been changed).
Some times after, I had to run composer install and I saw my symfony.lock updated. I don't know if it's related 🤔

[greysteil]

That definitely sounds related to me. I'm totally on-board with adding symfony.lock support, just want to make sure that I do it right.

[greysteil]

FYI, I've asked the symfony/flex team what they recommend Dependabot does here. It's not totally clear to me that Dependabot should be updating the symfony.lock file as I don't yet understand its purpose, but I'll get to the bottom of it 🙂

[Kocal]

Nice, good luck! 😛

[greysteil]

OK, having spoken to the folks at symfony/flex I think the best approach is for Dependabot to not keep the symfony.lock up-to-date.

As I understand it, the symfony.lock is there to keep track of what post-install scripts have been run, when downloading packages using Composer. Dependabot can't run those scripts for you, as it doesn't clone your repo, so it's better that it leaves the symfony.lock alone, even if it is out-of-date.

Running composer fix-recipes after a Dependabot install should fix up any symfony.lock issues.

I'm open to revisiting this at any time if anyone can think of a better solution. The discussion with symfony/flex is here.