Explicitly validate lock files everywhere: `composer validate --check-lock`

All 3 remaining failures are because our build tests are not keeping the composer.lock file up-to-date correctly.

📌 UnknownPathExcluder should use ComposerInspector instead of ComposerUtility Fixed landed.

📌 Remove FixtureManipulator::modifyPackage() last usage Fixed also landed!

I'm hoping somebody else can find whatever this last blocker is, I've already tried dozens of things 😬

I'll see how far I can take it.

I think I know what's happening here.

In PackageUpdateTest (the one I debugged), we are changing the definition of the repositories for the alpha and updated_module projects. The repository definitions are part of the hash that is used by Composer to determine if composer.lock and composer.json are out of sync. Since we change the repo definitions, but don't run a composer update (rightfully so) just before we call ComposerInspector::validate(), Composer freaks out.

The answer, I think, is that we cannot be changing the path repository definitions. In the test, we have to create the path repository once, then change its contents as needed.

Glad to be of service.

Woah! Yeah those build tests definitely are different beasts when it comes to their fixtures 😅 Never had to deal with them so far!

I have one question for you, @phenaproxima 🤓 I don't feel strongly about it, but I think what I suggested would be clearer. Curious what you think!

🏓

🏓

Quoth Wim in #11:

I don't feel strongly about it, but I think what I suggested would be clearer.

I tried to implement this suggestion but I couldn't get it to work. Since Wim doesn't feel strongly about it, I think this improvement to our tests has waited long enough. I'm happy with it.

🚀

… but that still means we need a follow-up issue to investigate, since we clearly do not understand why we need that extra composer update --lock. Not understanding that is not acceptable IMHO.

(I was fine with committing something that makes the overall system more stable, reliable and predictable. But I'm not fine with not understanding why we need a particular incantation 🪄😱)

We don’t need the incantation. I proved that. It’s removed from what I committed.

Given that I removed the mysterious incantation that wasn't needed (as I suspected it wasn't), I'm sending this back to fixed. AFAIK we don't need a follow-up.

Ahh, I confused this with the other thread on GitLab, and gave up waiting for GitLab's UI to finally load — apologies!

Even better 😊

Automatically closed - issue fixed for 2 weeks with no activity.