Using Asset Packagist for distributing assets in extensions

n-peugnet

I understand that this is the easiest way to include generated artifacts in composer packages as it rely only on sources repos, but I really don't like to commit generated assets in the VCS as it causes a lot of problems when merging and applying patches. This is an overall very bad practice.

In my quest to find a solution to this problem, I found Asset Packagist, which is kind of a proxy for Composer to install NPM packages. It seems quite interesting and I wonder if anyone here has already tried to use it.

From what I understand, it can be used independently by each packages so nobody will be forced to use it. I will probably experiment with it in the next few days.

clarkwinkelmann

If you don't want to push your generated files in your repository, there are a few other options:

Use a separate repository (or branches) for distribution files, separate from the main working repository. Manually or automatically sync between the 2, and set the distribution repository as the Packagist link.
Host your own distribution archives using a Satis-compatible endpoint, which you manually or automatically create from your working repository. This is kind of what Assets Packagist is probably doing, just automatically as a proxy.

If course users should be cautious adding third-party Packagist repositories since it could host a malicious copy of a popular dependency or even of Flarum itself. I believe since Composer v2 priority is well managed, as long as users don't disable Packagist itself in the list of sources it should be relatively safe.