Composer runs twice on first install of plugin

[rainbow-alex]

When installing for the first time (from a lock file), the plugin triggers an additional install:

...
Generating autoload files
  [merge-plugin] Running additional update to apply merge settings
Gathering patches for root package.
...

This doesn't seem necessary, at least not when you're installing from a lock. We'd like to avoid it because it also triggers the post install scripts twice...

[arlina-espinoza]

Running into this as well.

[bd808]

This is a classic "chicken and egg" problem. The second run is needed because composer-merge-plugin is not available to Composer until it has been installed. If the second installation run was not invoked by the plugin itself then no packages installed by composer-merge-plugin would be installed until a second manual run was made.

On the first pass, composer-merge-plugin as well as any dependencies specified directly in the project's composer.json are installed by Composer. During it's installation, composer-merge-plugin registers to receive a PackageEvents::POST_PACKAGE_INSTALL event callback from Composer itself when any package is installed. This callback (MergePlugin::onPostPackageInstall) checks the event, and if it is determined to be the announcement of composer-merge-plugin itself being installed it will then set an internal flag specifying that this is the initial install of the plugin for the current deployment. A second callback is also registered for the ScriptEvents::POST_INSTALL_CMD. This callback (MergePlugin::onPostInstallOrUpdate) is the one which checks for the initial installation flag and if it is set triggers a second run of Composer. This second pass happens after composer-merge-plugin has been fully installed and registered in Composer's environment which then allows it to install packages which are only known to composer-merge-plugin.

[bd808]

Related: #145

[bd808]

#252 is a potential work around for this issue. The proposed feature would introduce a new merge-plugin option to skip the second run and only use the composer.lock provided dependencies. This would not remove the chicken and egg problem outlined in #170 (comment), but it could be added to composer.json after first installing composer-merge-plugin and allowing it to process an update to add any dependencies from included files.