Two applications share a client library, so it should be a package. Packagist is public, running Satis is a server nobody has volunteered to own, and copying the directory into both projects is how it got this bad in the first place. Composer will install straight from a git URL, which is enough for a handful of internal packages.
{
"repositories": [
{
"type": "vcs",
"url": "[email protected]:packages/catalogue-client.git"
}
],
"require": {
"internal/catalogue-client": "~2.1"
}
}Composer clones the repository, reads the composer.json on every tag and branch, and builds a version list out of them — so the package needs a name matching the key you require and real tags, or all you get is dev-master. The cost is paid on resolution: each VCS repository is fetched before dependencies can be worked out, so composer update gets noticeably slower with every one you add, and this is precisely the pain Satis removes by reading them once and publishing a static packages.json. Authentication is the other half — the deploy machine needs a read-only key, and agent forwarding is a poor substitute for one because it makes the build depend on whoever happened to run it. Note also that --prefer-dist has no effect against a plain git host, since there is no archive to download.