Version 7.3.1 with wrong Composer manifest

[mbrodala]

• Deployer version: 7.3.1

Could it be that for a short time there was a broken 7.3.1 release pointing to 2370c31 with a wrong Composer manifest?

Currently the tag 7.3.1 points at c5c5e79 so it looks like the tag was moved to fix this. If that is the case then please consider adding a new tag if something like this happens again. This ensures existing references are not rendered invalid.

For reference this is the relevant part of our composer.lock:

        {
            "name": "deployer/deployer",
            "version": "v7.3.1",
            "source": {
                "type": "git",
                "url": "https://github.com/deployphp/deployer.git",
                "reference": "2370c319963fed08647473dd55d903655f500ecd"
            },
            "dist": {
                "type": "zip",
                "url": "https://api.github.com/repos/deployphp/deployer/zipball/2370c319963fed08647473dd55d903655f500ecd",
                "reference": "2370c319963fed08647473dd55d903655f500ecd",
                "shasum": ""
            },
            "require": {
                "ext-json": "*",
                "justinrainbow/json-schema": "^5.2",
                "php": "^8.0|^7.3",
                "psr/http-message": "^1",
                "react/http": "^1.5",
                "symfony/console": "^5.4.9",
                "symfony/polyfill-php80": "^1.22",
                "symfony/polyfill-php81": "^1.26",
                "symfony/process": "^5",
                "symfony/yaml": "^5"
            },
            "require-dev": {
                "pestphp/pest": "^1.0",
                "phpstan/phpstan": "^1.4",
                "phpunit/php-code-coverage": "^9.2",
                "phpunit/phpunit": "^9.3",
                "slevomat/coding-standard": "^7.0",
                "squizlabs/php_codesniffer": "^3.5",
                "symfony/var-exporter": "^5.4"
            },
            "bin": [
                "bin/dep"
            ],
            "type": "library",
            "autoload": {
                "files": [
                    "src/Support/helpers.php",
                    "src/functions.php"
                ],
                "psr-4": {
                    "Deployer\\": "src/"
                }
            },
            "notification-url": "https://packagist.org/downloads/",
            "license": [
                "MIT"
            ],
            "authors": [
                {
                    "name": "Anton Medvedev",
                    "email": "[email protected]"
                }
            ],
            "description": "Deployment Tool",
            "homepage": "https://deployer.org",
            "support": {
                "docs": "https://deployer.org/docs",
                "issues": "https://github.com/deployphp/deployer/issues",
                "source": "https://github.com/deployphp/deployer"
            },
            "funding": [
                {
                    "url": "https://github.com/sponsors/antonmedv",
                    "type": "github"
                }
            ],
            "time": "2023-04-05T08:35:21+00:00"
        },

You can see that there are requirements and a different bin which hints at a source release.

[antonmedv]

c5c5e79 commit is a special "package" commit with phar version of deployer.

In order to do this, release automation needs to move release tag to a new commit.

[mbrodala]

Thanks for the explanation. So as I understand this actually happens with every release? And only this time our update process was faster than the release process leaving us with a source instead of phar release? If that's the case then we'll add a delay before updating Deployer. (Using Renovate here.)

[antonmedv]

Yes. Every release is like this. Starting from v7.