How to (temporary) depend on a dangling commit (from a pull request)?

[ruudk]

I want to start testing my CI on PHP 8.3 (not yet released).

I have a dependency on moneyphp/money that is, at the time of writing, not yet compatible with PHP 8.2.

However, there is a PR that adds support: moneyphp/money#757

I know I can depend on this fork, by doing:

{
    "repositories": [
        {
            "type": "vcs",
            "url": "https://github.com/asbiin/money.git",
            "comment": "https://github.com/moneyphp/money/pull/757"
        }
    ],
    "require": {
        "moneyphp/money": "dev-php83"
    }
}

But having to create the custom repositories is tedious to write.

A much simpler way to write is this:

{
    "require": {
        "moneyphp/money": "dev-master#cea5ff8ef5acc86697c63ef80553679ae5c3a36a"
    }
}

This works, because commits associated to a pull request, are also available inside as commits in the target repository.

When you open the commit on GitHub, you would see:

This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.

(after I wrote this discussion, the commit was merged, and therefore the message above is gone).

Now when I install this on PHP 8.2, it just works. I verify that I get the forked code.

But when I install it on PHP 8.3 it doesn't:

I understand why this is.

I tell composer to install a commit from dev-master. And I think it uses dev-master information from packagist.org to do the requirements checking.

Is there a way to tell composer to read the information from the commit? Bypassing dev-master from packagist?

This would make it way easier to (temporary) use a forked commit that's pending merge / tagging.

[stof]

The commit-pinning feature is an installer-level hack changing which commit gets downloaded. It has no way to be taken into account by the solver because composer repositories don't create versions for each commit (this would make composer consume TB of memory quite quickly).

If you want to use a version from a different branch properly, there is no other way than registering the fork as a repository and requiring the version for the branch you want to use.

[ruudk]

Thanks, that explains what I'm seeing.

So basically, we can use the commit-pinning as long as the composer requirements are the same.

But since this type of PR was changing the composer.json, it was not working.