fix: pass COMPOSER_INSTALL_OPTIONS from options.json to composer extension

COMPOSER_INSTALL_OPTIONS set in .bp-config/options.json was silently
ignored because supply.go never wrote the parsed value into the
extension Context.Data map. The composer extension reads it back via
ctx.GetStringSlice(), which returned nil, causing the hardcoded default
["--no-interaction", "--no-dev"] to always be used.

Fix: add ctx.Set("COMPOSER_INSTALL_OPTIONS", s.Options.ComposerInstallOptions)
alongside the other options already written to the context.

Adds a regression integration test with a fixture app that sets
COMPOSER_INSTALL_OPTIONS to ["--dev"] and verifies that a require-dev
package (psr/log) is installed and accessible at runtime.

Fixes #1265

Author: ramonskie

fixtures/composer_install_options/.bp-config/options.json

@@ -0,0 +1,3 @@
+{
+    "COMPOSER_INSTALL_OPTIONS": ["--dev"]
+}

fixtures/composer_install_options/composer.json

@@ -0,0 +1,9 @@
+{
+    "name": "cloudfoundry/composer_install_options_test",
+    "require": {
+        "php": ">=8.1"
+    },
+    "require-dev": {
+        "psr/log": "^3.0"
+    }
+}

fixtures/composer_install_options/composer.lock

@@ -0,0 +1,11 @@
+<?php
+require '../lib/vendor/autoload.php';
+
+// psr/log is a require-dev dependency.
+// If COMPOSER_INSTALL_OPTIONS: ["--dev"] is honoured, this class exists.
+if (interface_exists('Psr\Log\LoggerInterface')) {
+    echo "dev dependencies installed";
+} else {
+    http_response_code(500);
+    echo "dev dependencies missing";
+}

fixtures/composer_install_options/htdocs/index.php

@@ -117,6 +117,28 @@ func testComposer(platform switchblade.Platform, fixtures string) func(*testing.
 			})
 		})
 
+		// Regression test for https://github.com/cloudfoundry/php-buildpack/issues/1265
+		// COMPOSER_INSTALL_OPTIONS in options.json was silently ignored in v5 because
+		// supply.go never wrote the parsed value into the extension Context.Data map.
+		// As a result, composer always ran with the hardcoded default ["--no-interaction",
+		// "--no-dev"], making it impossible to install dev dependencies via options.json.
+		context("composer app with COMPOSER_INSTALL_OPTIONS set to --dev in options.json", func() {
+			it("installs dev dependencies (issue #1265)", func() {
+				deployment, logs, err := platform.Deploy.
+					WithEnv(map[string]string{
+						"COMPOSER_GITHUB_OAUTH_TOKEN": os.Getenv("COMPOSER_GITHUB_OAUTH_TOKEN"),
+					}).
+					Execute(name, filepath.Join(fixtures, "composer_install_options"))
+				Expect(err).NotTo(HaveOccurred(), logs.String)
+
+				// Staging log must NOT contain --no-dev, confirming the user option overrides the default
+				Expect(logs.String()).NotTo(ContainSubstring("--no-dev"))
+
+				// The running app confirms psr/log (a require-dev package) was installed
+				Eventually(deployment).Should(Serve(ContainSubstring("dev dependencies installed")))
+			})
+		})
+
 		if !settings.Cached {
 			context("deployed with invalid COMPOSER_GITHUB_OAUTH_TOKEN", func() {
 				it("logs warning", func() {

src/php/integration/composer_test.go

@@ -201,6 +201,7 @@ func (s *Supplier) createExtensionContext() (*extensions.Context, error) {
 	// Set additional options
 	ctx.Set("ADMIN_EMAIL", s.Options.AdminEmail)
 	ctx.Set("COMPOSER_VENDOR_DIR", s.Options.ComposerVendorDir)
+	ctx.Set("COMPOSER_INSTALL_OPTIONS", s.Options.ComposerInstallOptions)
 
 	// Set dynamic PHP version variables
 	for key, version := range s.Options.PHPVersions {