Drupal 8 and Composer - working with cloned dependencies

If you use the Drupal Composer Drupal Project template for managing your Drupal 8 site’s codebase, and you commit dependencies to your Git repository, then you’ve probably run into issues involving cloned dependencies. Sometimes when requiring a dependency via Composer, you end up with a cloned version (which includes a .git directory) instead of a release version. 

If you’re committing dependencies to your repository, then the .git directories associated with cloned dependencies cause an issue when you try to commit. A common resolution is to remove the .git directory from the dependency’s directory.

While this solves the immediate issue, the next time you go to update Drupal core, you’ll likely see an error message along the lines of, “The .git directory is missing from /var/www/html/vendor/some/dependency, see https://getcomposer.org/commit-deps for more information”. How can we get past this?

Here’s my workflow:

1. Delete the entire /vendor/ directory.
2. Run “composer install” to reinstall all dependencies. 
3. Update Drupal core (normally with “composer update drupal/core webflo/drupal-core-require-dev "symfony/*" --with-dependencies”
4. Re-remove any .git directories for cloned dependencies.
5. Commit the update.

Ultimately the "proper" solution will be to not commit dependencies to the project repository. I agree that this is the best solution, but not everyone’s workflow currently supports this.

There's also a great discussion in the Drupal Composer Drupal Project issue queue about alternate methods to deal with this issue. 

Have a different workflow to deal with cloned dependencies? Share it in a comment below!

Just getting started with managing your Drupal 8 project with Composer? Jeff Geerling has some super-helpful blog posts.