Manage composer via mise

[oschwald]

Summary

The release script previously used a local composer.phar kept current via self-update. This installs it via mise's github: backend instead, pinned in mise.lock with per-platform checksums; mise additionally verifies GitHub artifact attestations at install time. Future upgrades are mise upgrade rather than relying on whatever self-update fetches at release time.

The php -n -dextension=ext/modules/maxminddb.so wrapper is kept (now resolving the phar via command -v) so composer continues to see the built ext-maxminddb as a platform package.

Same change as maxmind/GeoIP2-php#321 and maxmind/minfraud-api-php (on its greg/stf-1074 release branch), which also migrate box and phpDocumentor there.

Testing

php -n "$(mise which composer.phar)" --version runs the mise-installed phar successfully; bash -n on the release script passes.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated release tooling to pre-flight check for Composer availability before starting the build.
  • Streamlined the Composer dependency update process by invoking the resolved Composer phar via PHP.
  • Added Composer to the managed development tools configuration (latest version).
  • Updated Git ignore rules so composer.phar is no longer ignored.

[coderabbitai]

📝 Walkthrough

Walkthrough

Composer is added to mise-managed tools, removed from .gitignore, validated during release pre-flight checks, and invoked through its resolved path during dependency updates.

Changes

Composer release tooling

Layer / File(s)	Summary
Composer provisioning and release execution .gitignore, mise.toml, dev-bin/release.sh	Composer is provisioned through mise, no longer ignored, checked before release, and run via its resolved path without self-update.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

I’m a rabbit with a Composer key,
Mise brings the tool for me.
No ignored phar hides away,
Releases check it before they play.
Hop, update, and build with cheer!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: Composer is now managed through mise.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch greg/stf-1074

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@dev-bin/release.sh`:
- Around line 38-40: Update the composer.phar handling in the release script to
resolve the executable’s real path with `mise which composer.phar` after
`check_command composer.phar` and before the PHP invocation. Store and use that
resolved path so php receives the actual phar rather than the mise shim.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 27edeb8e-a9f6-4ee0-aa80-74ea1c2a1e63

📥 Commits

Reviewing files that changed from the base of the PR and between 4e9ccee and a7b04ca.

⛔ Files ignored due to path filters (1)

• mise.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

• .gitignore
• dev-bin/release.sh
• mise.toml

💤 Files with no reviewable changes (1)

• .gitignore

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

dev-bin/release.sh (1)

38-40: 🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

Resolve composer.phar through mise during preflight. check_command composer.phar only checks PATH, so it can pass against a different binary than mise which composer.phar later executes. Resolve once with mise, validate that path, and reuse it.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@dev-bin/release.sh` around lines 38 - 40, Update the preflight logic around
check_command for composer.phar to resolve the executable once via mise,
validate the resolved path, and reuse that same path for the later execution
instead of separately relying on PATH lookup.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@dev-bin/release.sh`:
- Around line 38-40: Update the preflight logic around check_command for
composer.phar to resolve the executable once via mise, validate the resolved
path, and reuse that same path for the later execution instead of separately
relying on PATH lookup.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 1d33e5e0-ed58-40a7-9cde-6cec291a2851

📥 Commits

Reviewing files that changed from the base of the PR and between a7b04ca and 84f1296.

📒 Files selected for processing (1)

• dev-bin/release.sh