Install contrib module dependencies specified in info.yml file (when no composer.json file exists)

Shouldn't module dependencies be defined in the "require" section of the "composer.json" file within the module?

I'd expect them to be in require-dev.

Test dependencies should be in the require-dev section.
Module dependencies should be in the require section.

The composer step just builds the code according to what it says in the composer.json file.

I meant the explicit module dependency, i.e. something required for module to run.

That dependency would be included in require section of composer.json file generated for module release; however, if the module does not include the file (which is ok, contrib modules currently doesn't require to have it), it won't be generated during CI run (which runs on a git ref) and thus the dependency won't be installed.

Probably the CI should generate the composer.json if it's not included in module repository.

Updated issue summary to clearly state that this issue is happening if there's no composer.json file committed in a module repository.

#6: Ahhh, now that makes more sense!

You're right that the Drupal.org composer facade has been generating composer.json for years. You've only needed to define one if and only if your depending on non drupal/* packages. (Also see @mixologic's comment at https://www.drupal.org/drupalorg/blog/drupalorgs-composer-endpoints-are-... → — it's the 4th comment.)

Relevant issue: #2551703: Store composer.json if present → .

I think it makes sense that with the switch from DrupalCI to GitLab CI, we start requiring composer.json instead of providing dark magic to have it happen automatically. And in fact … that would very much pave the path for ✨ Replace .info.yml with composer.json for extensions Postponed (which is postponed on #3250765: [meta] Clean up .info.yml files → ).

Agree with #8. This is Wont Fix or By Design.

I don't think it's a good idea to require having module dependencies defined in both composer.json and info.yml. I have seen enough times that people updated a version constraint in one file but not the other, leading to confusing situations. As long as having module dependencies in info.yml is required, we shouldn't also make it required in composer.json, to make sure contrib modules maintain a single source of truth for their dependencies. And if we do decide to make both required, this should probably be communicated in a change record or in some form of documentation, instead of being hidden in some comment in a core issue.