Hard-coded dependency on composer.json blocks different composer environments

[alexc-jeromes]

Bug description

We use composer.local.json and composer.production.json which are decided on with the env var COMPOSER=${ENV}.

This works fine within Laravel as it uses Composer's env vars. Statamic has hard-coded links to composer.json which error hard during package:discover and other commands.

Example:

Statamic\Console\Composer\Json

$composerJson = File::get($path = base_path('composer.json'));

How to reproduce

cp composer.json composer.testing.json
mv composer.json composer.bak
export COMPOSER=composer.testing.json
composer update

Logs

No response

Environment

Environment
Laravel Version: 11.20.0
PHP Version: 8.3.7
Composer Version: 2.7.6
Environment: local
Debug Mode: ENABLED
URL: localhost
Maintenance Mode: OFF
Timezone: UTC
Locale: en

Cache
Config: NOT CACHED
Events: NOT CACHED
Routes: NOT CACHED
Views: CACHED

Drivers
Broadcasting: log
Cache: redis
Database: pgsql
Logs: daily
Mail: smtp
Queue: sync
Session: redis

Livewire
Livewire: v3.5.4

Statamic
Addons: 48
Sites: 1
Stache Watcher: Enabled
Static Caching: Disabled
Version: 5.19.0 PRO

Statamic Addons
daynnnnn/statamic-forward-auth: dev-develop
statamic/eloquent-driver: 4.12.2
stillat/antlers-layouts: 2.1.0

Statamic Eloquent Driver
Asset Containers: eloquent
Assets: eloquent
Blueprints: eloquent
Collection Trees: eloquent
Collections: eloquent
Entries: eloquent
Forms: eloquent
Global Sets: eloquent
Global Variables: eloquent
Navigation Trees: eloquent
Navigations: eloquent
Revisions: eloquent
Sites: file
Taxonomies: eloquent
Terms: eloquent
Tokens: file

Installation

Fresh statamic/statamic site via CLI

Additional details

No response

[duncanmcclean]

Out of curiosity, what's your use case for different composer.json files per environment? Surely, you'd want the same dependencies installed in all environments?

[alexc-jeromes]

Developing new addons (we have 40+ custom), basically. We build them into the addons/ dir, then they are committed into a Gitlab repo, which is connected to a Satis Server composer registry. Production uses the remote, local devs use the addons path.

Devs need to use their dev copy of a package/addon when running Composer, and production must only use the code they produce which has had its tests/stability tagged.

[duncanmcclean]

When I've ever needed to do that in the past, I've achieved it by adding the repositories to my global composer.json/config.json files, instead of creating separate composer.json files:

{
    "repositories": [
        {
            "type": "path",
            "url": "~/Code/path-to-addon-one"
        },
        {
            "type": "path",
            "url": "~/Code/path-to-addon-two"
        },
    ]
}