Composer usage

[gamort]

Does passing the more secure "--no-dev" argument to composer cause any issues for installation/upgrade?

[ghost]

Thanks for bringing this to our attention. We're going to investigate and get back to you.

[ghost]

We are tracking this with internal issue MAGETWO-52095.

[ghost]

@gamort Repeating my request for information from internal resources. Hope to have an update soon.

[ghost]

There is no progress on the issue yet.

[hostep]

I can weigh in a little bit on this matter.
In Magento 2.0.x it used to be a problem when using the --no-dev argument (at least in versions up to 2.0.7, I'm not sure about 2.0.8, 2.0.9 or later versions).
But in Magento 2.1.x you can safely use that flag on a production system.

See this entire thread for more info: magento/magento2#2561

[ghost]

I'm asking because I don't know ... what is the reason someone would use --no-dev?

[hostep]

To not install the development dependencies on a production server. Since those files aren't necessary on a production system.
See the main Magento 2 composer.json file, it contains a require section, and a require-dev section. If you run composer install --no-dev it will only install the dependencies from the require section and skip the ones from the require-dev section. Since they mostly contain testing or static analyzer tools, you don't need those things on a production server.

We even go a few steps further and run this on a production system:

composer install --no-dev --prefer-dist --optimize-autoloader

I also tried appending the --classmap-authoritative flag for an even more improved autoloader performance, but couldn't get that working with Magento 2 unfortunately.

Check the composer docs for all the details: https://getcomposer.org/doc/03-cli.md#install

[ghost]

It looks like these subcommands also work with composer create-project which I'd prefer to document because you're not supposed to use a clone in production.

Or how do you use composer install?

[hostep]

Hi Steve

This is more of a topic which should be discussed over here: #419

But we always run composer install every time we deploy a new version to a production system.

composer create-project is only necessary to set up the initial project one single time and then put the generated composer files into your version control system. You should always do this on your local system where you actually need those development dependencies, so never on a production system.

This is the way the advanced users of Magento 2 work. For simple shop owners who have a little bit of technical knowledge this is probably not the way they'll work, because they won't understand how composer work and they will probably use the archived Magento install.

I hope this helps a bit?

[ghost]

I think @hostep is correct that this issue is basically a duplicate of #419 ; therefore, closing this issue.

We expect to have a better and more comprehensive story about production deployment in the Magento 2.2 timeframe, but I don't know what that is.

MAGETWO-52095 is still open, unresolved.