Warning about missing `composer.lock` on getting started guide

[schneems]

This warning:

No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.

Is odd because there's a composer.lock file checked in:

$ git ls-files | grep lock
composer.lock

Reproduction

$ git clone https://github.com/heroku/php-getting-started
Cloning into 'php-getting-started'...
cd remote: Enumerating objects: 270, done.
remote: Counting objects: 100% (60/60), done.
remote: Compressing objects: 100% (46/46), done.
remote: Total 270 (delta 33), reused 16 (delta 14), pack-reused 210 (from 3)
Receiving objects: 100% (270/270), 92.79 KiB | 1.50 MiB/s, done.
Resolving deltas: 100% (114/114), done.
$ cd php-getting-started
$ pack build my-image-name-php --path . --clear-cache
Warning: Exporting to docker daemon (building without --publish) and daemon uses containerd storage; performance may be significantly degraded.
For more information, see https://github.com/buildpacks/pack/issues/2272.
24: Pulling from heroku/builder
Digest: sha256:e0b45ad375ed202922ae1b06f2b28eb63ceac948c8eb17bdb14900cfa1432ea8
Status: Image is up to date for heroku/builder:24
24: Pulling from heroku/heroku
Digest: sha256:e8c68846121d344ae394de15af7c0f4c00659d6125b5eda95a07fa0a27d1c6fd
Status: Image is up to date for heroku/heroku:24
===> ANALYZING
Image with name "my-image-name-php" not found
===> DETECTING
2 of 3 buildpacks participating
heroku/php      0.2.1
heroku/procfile 4.2.0
===> RESTORING
Skipping buildpack layer analysis
===> BUILDING

[Bootstrapping]

[Preparing platform packages installation]

[Installing platform packages]
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 26 installs, 0 updates, 0 removals

[edmorley]

This is still occurring - eg this is from a Direwolf PHP CNB w/PHP getting started run:

remote: Generating autoload files        
remote: �[0m�[1m�[35m�[0m        
remote: �[0m�[1m�[35m[Installing web servers]�[0m        
remote: No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.        
remote: Loading composer repositories with package information        

[schneems]

Some info: These warnings are coming because the buildpack is using composer to install things outside of the application directory, more docs are here https://github.com/heroku/heroku-buildpack-php/tree/86d85038a27f17254164d68dffbbe580f5ea58ea/support/installer. This is the same approach that the classic buildpack uses because it downloads and uses parts of the classic buildapack (on the cnb-installer branch)

buildpacks-php/buildpacks/php/src/bootstrap.rs

Line 59 in 4d3f920

"https://github.com/heroku/heroku-buildpack-php/archive/refs/{CLASSIC_BUILDPACK_VERSION}.tar.gz",

.

The reason this doesn't happen in the classic buildpack is the output is filtered (https://github.com/heroku/heroku-buildpack-php/blob/86d85038a27f17254164d68dffbbe580f5ea58ea/bin/compile#L424):

Raw output:

$ cat out.txt
No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 4 installs, 0 updates, 0 removals
  - Locking heroku-sys/apache (2.4.62)
  - Locking heroku-sys/nginx (1.26.2)
  - Locking heroku/heroku-buildpack-php (dev-bundled)
  - Locking heroku/installer-plugin (1.8.0)
Writing lock file
Installing dependencies from lock file
Package operations: 4 installs, 0 updates, 0 removals
  - Installing heroku/installer-plugin (1.8.0): Mirroring from /layers/heroku_php/bootstrap_installer/support/installer
  - Downloading heroku-sys/apache (2.4.62)
  - Downloading heroku-sys/nginx (1.26.2)
 0/2 [>---------------------------]   0%
 1/2 [==============>-------------]  50%
 2/2 [============================] 100%
  - Installing heroku-sys/apache (2.4.62)
  - Installing heroku-sys/nginx (1.26.2)
  - Installing heroku/heroku-buildpack-php (dev-bundled): Mirroring from /layers/heroku_php/bootstrap_installer
    0 [>---------------------------]    0 [->--------------------------]
Generating autoload files

Filtered:

$ cat out.txt | ( grep --line-buffered -E '^  - (Instal|Enab)ling heroku-sys/' | sed -u -E -e 's/^  - (Instal|Enab)ling /- /' -e 's/heroku-sys\///g' || true )
- apache (2.4.62)
- nginx (1.26.2)

Other info

Here's how to generate the full output from invoking a composer install https://gist.github.com/schneems/58b2a2f86819334e67d9b1cf51ca354a.

Here's the full output we're filtering in the buildpack:

No composer.lock file present. Updating dependencies to latest instead of installing from lock file. See https://getcomposer.org/install for more information.
Loading composer repositories with package information
Updating dependencies
Lock file operations: 29 installs, 0 updates, 0 removals
  - Locking composer.json/composer.lock (dev-a111f8a08a22381b72dcdd5cd3df9d9b)
  - Locking fig/http-message-util (1.1.5)
  - Locking heroku-sys/apache (2.4.63)
  - Locking heroku-sys/composer (2.8.8)
  - Locking heroku-sys/nginx (1.26.3)
  - Locking heroku-sys/php (8.4.6)
  - Locking heroku/installer-plugin (1.7.2)
  - Locking laravel/serializable-closure (v1.3.7)
  - Locking monolog/monolog (3.8.0)
  - Locking nikic/fast-route (v1.3.0)
  - Locking php-di/invoker (2.3.4)
  - Locking php-di/php-di (7.0.7)
  - Locking php-di/slim-bridge (3.4.1)
  - Locking psr/container (2.0.2)
  - Locking psr/http-factory (1.1.0)
  - Locking psr/http-message (2.0)
  - Locking psr/http-server-handler (1.0.2)
  - Locking psr/http-server-middleware (1.0.2)
  - Locking psr/log (3.0.2)
  - Locking ralouphie/getallheaders (3.0.3)
  - Locking slim/psr7 (1.7.0)
  - Locking slim/slim (4.14.0)
  - Locking slim/twig-view (3.4.1)
  - Locking symfony/deprecation-contracts (v3.5.1)
  - Locking symfony/polyfill-ctype (v1.31.0)
  - Locking symfony/polyfill-mbstring (v1.31.0)
  - Locking symfony/polyfill-php80 (v1.31.0)
  - Locking symfony/polyfill-php81 (v1.31.0)
  - Locking twig/twig (v3.16.0)
Writing lock file
Installing dependencies from lock file
Package operations: 29 installs, 0 updates, 0 removals
  - Installing heroku/installer-plugin (1.7.2): Mirroring from heroku-buildpack-php/support/installer
  - Downloading heroku-sys/php (8.4.6)
  - Downloading heroku-sys/apache (2.4.63)
  - Downloading heroku-sys/composer (2.8.8)
  - Downloading heroku-sys/nginx (1.26.3)
  - Installing heroku-sys/php (8.4.6)
  - Installing composer.json/composer.lock (dev-a111f8a08a22381b72dcdd5cd3df9d9b)
  - Installing fig/http-message-util (1.1.5)
  - Installing heroku-sys/apache (2.4.63)
  - Installing heroku-sys/composer (2.8.8)
  - Installing heroku-sys/nginx (1.26.3)
  - Installing laravel/serializable-closure (v1.3.7)
  - Installing monolog/monolog (3.8.0)
  - Installing nikic/fast-route (v1.3.0)
  - Installing php-di/invoker (2.3.4)
  - Installing php-di/php-di (7.0.7)
  - Installing php-di/slim-bridge (3.4.1)
  - Installing psr/container (2.0.2)
  - Installing psr/http-factory (1.1.0)
  - Installing psr/http-message (2.0)
  - Installing psr/http-server-handler (1.0.2)
  - Installing psr/http-server-middleware (1.0.2)
  - Installing psr/log (3.0.2)
  - Installing ralouphie/getallheaders (3.0.3)
  - Installing slim/psr7 (1.7.0)
  - Installing slim/slim (4.14.0)
  - Installing slim/twig-view (3.4.1)
  - Installing symfony/deprecation-contracts (v3.5.1)
  - Installing symfony/polyfill-ctype (v1.31.0)
  - Installing symfony/polyfill-mbstring (v1.31.0)
  - Installing symfony/polyfill-php80 (v1.31.0)
  - Installing symfony/polyfill-php81 (v1.31.0)
  - Installing twig/twig (v3.16.0)
Generating autoload files

Classic is converting these lines:

  - Downloading heroku-sys/php (8.4.6)
  - Installing heroku-sys/apache (2.4.63)
  - Installing heroku-sys/composer (2.8.8)
  - Installing heroku-sys/nginx (1.26.3)

Into:

remote:        - php (8.4.6)
remote:        - apache (2.4.63)
remote:        - composer (2.8.8)
remote:        - nginx (1.26.3)

[schneems]

Here's my short term suggestions:

• Uncomment this line to reduce the output

  buildpacks-php/buildpacks/php/src/layers/platform.rs

  Line 68 in 4d3f920

  //"--no-progress",

• Switch from composer install to composer update which does not have this warning:

$ composer update --no-dev --no-interaction --no-progress 2>&1 | tee out.txt
Loading composer repositories with package information
Updating dependencies
Lock file operations: 29 installs, 0 updates, 0 removals
  - Locking composer.json/composer.lock (dev-a111f8a08a22381b72dcdd5cd3df9d9b)
  - Locking fig/http-message-util (1.1.5)
  - Locking heroku-sys/apache (2.4.63)
  - Locking heroku-sys/composer (2.8.8)
  - Locking heroku-sys/nginx (1.26.3)

Even with the docs https://github.com/heroku/heroku-buildpack-php/tree/main/support/installer on how this all fits together, I'm still not confident in my understanding of the broader picture to suggest any other changes in architecture or approaches.