Bundled production dependencies only in the PHAR and pinned Box. (#335)

AlexSkrypnyk · web-flow · commit d40a613f5313 · 2026-06-20T17:11:25.000+10:00
diff --git a/.dockerignore b/.dockerignore
@@ -8,4 +8,4 @@
 .logs
 tests
 vendor
-vendor-bin
+vendor-bin/*/vendor
diff --git a/.gitignore b/.gitignore
@@ -4,4 +4,4 @@
 /.build
 /.logs
 /vendor
-/vendor-bin
+/vendor-bin/*/vendor
diff --git a/box.json b/box.json
@@ -3,10 +3,12 @@
     "compression": "GZ",
     "finder": [
         {
-            "in": "./",
+            "in": [
+                "src",
+                "vendor"
+            ],
             "exclude": [
-                "php-script",
-                "tests"
+                "bin"
             ]
         }
     ]
diff --git a/composer.json b/composer.json
@@ -66,7 +66,7 @@
     },
     "scripts": {
         "build": [
-            "@composer bin box require --dev humbug/box",
+            "@composer bin box install",
             "box validate",
             "box compile"
         ],
diff --git a/vendor-bin/box/composer.json b/vendor-bin/box/composer.json
@@ -0,0 +1,5 @@
+{
+    "require": {
+        "humbug/box": "^4.7"
+    }
+}
diff --git a/vendor-bin/box/composer.lock b/vendor-bin/box/composer.lock

-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +{
 +    "require": {
 +        "humbug/box": "^4.7"
 +    }
 +}