How to use composer prp without installing dev packages

[James-Oakley]

I have a number of packages in the require-dev section of composer.json. In a development environment, they help me test and debug. In production, I install with composer install --no-dev.

I have a number of patches in patches.json. In production, I'll run composer prp after the install command, so all the necessary patches are applied. First, it deletes all the packages that need patching. Before downloading those again, I see Installing dependencies from lock file (including require-dev). Sure enough, composer goes on to download all the packages in require-dev. This means I now have all of those packages installed (but not enabled) in the production environment.

Do I need to change my workflow? Or is this a bug / feature of composer prp?

[James-Oakley]

OK, I've found a workflow that works. If you install again after patching, it removes any packages that shouldn't be there, but doesn't undo the patching

composer install --no-dev --optimize-autoloader
composer patches-repatch
composer install --no-dev --optimize-autoloader

My question is whether this is intended behaviour, and so the correct workflow, or if this is not the way things are supposed to be.