How to make laravel a composer dependency for my project - php

Question

My project is a Laravel implementation. I have created a composer.json file as follows:
{
"name": "company/project",
"description": "My cool project.",
"type": "project",
"license": "proprietary",
"require": {
"laravel/laravel": "8.*"
}
}
I can put this file in its own directory and run composer install. This installs version 8 of laravel/laravel and all dependencies in the vendor/ directory. But this is not a valid Laravel installation. If I then move the contents of vendor/laravel/laravel up into the main directory, copy .env.example to .env and run composer -o dump-autoload, then I have a directory structure that looks (as far as I can tell), just like a standard Laravel installation.
However, when I try to access the site from by browser, I get a 500 Server Error, with no apparent entries in the Apache or Laravel logs.
I know this is not an Apache configuration error because I can create exactly the same site using the command composer create-project laravel/laravel:8.* {directory}, and I get a function basic Laravel site.
My ultimate goal is to use composer to install my project AND Laravel, with all of it's dependencies, and get a functioning site. I am particularly interested in being able to lock all of the dependencies (including the specific version of laravel/laravel) via the composer.lock file, which will then be included with the version-controlled source of my project.
You may ask why I don't just use the recommended command to create a clean Laravel installation and just version-control the resultant composer.lock file. The reason is: That file does not contain the specific version of laravel/laravel. So when I then user the composer.json/lock files in a clean directory, the core laravel/larvel files are missing.
Any pointers as to what I am doing wrong? Or is there a simpler way to achieve my goal?

Answer 1

Your composer.json only requires "laravel/laravel": "8.*", but Laravel needs a lot more to function properly. When I do a composer create-project laravel/laravel it generates a composer.json with the following:
{
"name": "laravel/laravel",
"type": "project",
"description": "The Laravel Framework.",
"keywords": ["framework", "laravel"],
"license": "MIT",
"require": {
"php": "^7.3|^8.0",
"fruitcake/laravel-cors": "^2.0",
"guzzlehttp/guzzle": "^7.0.1",
"laravel/framework": "^8.54",
"laravel/sanctum": "^2.11",
"laravel/tinker": "^2.5"
},
"require-dev": {
"facade/ignition": "^2.5",
"fakerphp/faker": "^1.9.1",
"laravel/sail": "^1.0.1",
"mockery/mockery": "^1.4.2",
"nunomaduro/collision": "^5.0",
"phpunit/phpunit": "^9.3.3"
},
"autoload": {
"psr-4": {
"App\\": "app/",
"Database\\Factories\\": "database/factories/",
"Database\\Seeders\\": "database/seeders/"
}
},
"autoload-dev": {
"psr-4": {
"Tests\\": "tests/"
}
},
"scripts": {
"post-autoload-dump": [
"Illuminate\\Foundation\\ComposerScripts::postAutoloadDump",
"#php artisan package:discover --ansi"
],
"post-update-cmd": [
"#php artisan vendor:publish --tag=laravel-assets --ansi"
],
"post-root-package-install": [
"#php -r \"file_exists('.env') || copy('.env.example', '.env');\""
],
"post-create-project-cmd": [
"#php artisan key:generate --ansi"
]
},
"extra": {
"laravel": {
"dont-discover": []
}
},
"config": {
"optimize-autoloader": true,
"preferred-install": "dist",
"sort-packages": true
},
"minimum-stability": "dev",
"prefer-stable": true
}
Now this does a lot more than just requiring a vendor-folder, these contain the namespace-declarations, scripts, and the requirements for a few more things.
And also note that this requires laravel/framework instead of laravel/laravel.
All in all I suggest using the full list from here and keep stripping until it breaks if you want to.
And on the subject of version pinning, you could either put the composer.lock-file in your VCS and only run composer install (that does not update if there is lock-file).
You could also remove the ^ from all the versions that you don't want to update, that way you can restrict a version with some room for updates if you want. 8.0.1 would keep at 8.0.1, but you could allow patches by specifying 8.0.* as a version-requirement.

Answer 2

In the end, I gave up trying to make this work. Instead, I now follow these steps to install a new site:
composer create-project --no-install --no-scripts laravel/laravel:{version} {SITE}
cd {SITE}
svn export --force {repo}/composer.json .
svn export --force {repo}/composer.lock .
composer install
svn co {repo} .
svn -R revert .
This allows me to create a site with the specific version of Laravel that I need.