Manage composer via mise

The release script previously used a local composer.phar kept current
via self-update. Install it via mise's github backend instead. The
version is pinned in mise.lock, which records per-platform checksums,
and mise additionally verifies GitHub artifact attestations at install
time. The php -n -dextension=... wrapper is kept so composer continues
to see the built ext-maxminddb as a platform package.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: oschwald

.gitignore

@@ -20,7 +20,6 @@ ac*.m4
 autom4te.cache/
 build/
 composer.lock
-composer.phar
 config.[^mw]*
 configure*
 core

dev-bin/release.sh

@@ -35,6 +35,9 @@ check_command php
 check_command phpize
 check_command pecl
 
+# composer.phar is managed by mise (see mise.toml)
+check_command composer.phar
+
 # Check that we're not on the main branch
 current_branch=$(git branch --show-current)
 if [ "$current_branch" = "main" ]; then
@@ -100,8 +103,7 @@ phpize
 make
 popd
 
-php -n -dextension=ext/modules/maxminddb.so composer.phar self-update
-php -n -dextension=ext/modules/maxminddb.so composer.phar update
+php -n -dextension=ext/modules/maxminddb.so "$(mise which composer.phar)" update
 
 php -n -dextension=ext/modules/maxminddb.so ./vendor/bin/phpunit
 php -n ./vendor/bin/phpunit

mise.lock

@@ -2,6 +2,7 @@
 lockfile = true
 
 [tools]
+"github:composer/composer" = "latest"
 lychee = "latest"
 
 [tasks.check-links]