Composer-managed WordPress, and four commercial plugins that ship as a zip behind a licence key.
{
"repositories": [
{
"type": "package",
"package": {
"name": "vendor/premium-plugin",
"version": "4.2.1",
"type": "wordpress-plugin",
"dist": {
"type": "zip",
"url": "https://vendor.example/download?key={$LICENCE_KEY}"
}
}
}
]
}An inline package definition with a version that has to be bumped by hand is the honest option — there is no feed, so there is no way for Composer to discover a new release. The alternative everybody reaches for is committing the zip, which works and puts a licensed binary in version control, and the third option is a private Composer repository that somebody has to run.