Composer

Every workspace has a Composer repository of its own, made from its repositories: one with a composer.json at its root is a package. There is nothing to upload and nothing to keep in step. Push a tag and Composer can install it; push to a branch and its dev- version follows.

https://g1t.sh/-/composer/<workspace>/

Make a repository a package

Give the repository a composer.json at its root with a name:

{
  "name": "acme/http-client",
  "description": "Our HTTP client",
  "type": "library",
  "require": { "php": ">=8.1" },
  "autoload": { "psr-4": { "Acme\Http\\": "src/" } }
}

Push it to the default branch, and the package appears in the workspace’s Packages, linked to the repository, with its README. Any vendor name works; each name is one package in a workspace.

Versions

In git	Version
A tag that reads as a version: v1.2.0, 1.2.0, 2.0.0-RC1, 1.0.0-beta.2	That version (v1.2.0)
A branch	dev-<branch>; a branch named like a version, 1.x, is 1.x-dev
The default branch	Its dev- version, marked as the default branch

Each version’s requirements, autoloading and the rest are read from the composer.json at that tag or branch, so a version installs exactly what it was tagged with. Tags that do not read as versions, such as nightly, are left out. extra.branch-alias in the default branch’s composer.json aliases it as usual ("dev-main": "1.x-dev").

To release, tag and push:

git tag v1.3.0
git push origin v1.3.0

Deleting a tag or branch takes its version away.

Install

Add the workspace’s repository to your project, then require the package:

composer config repositories.acme composer https://g1t.sh/-/composer/acme/
composer require acme/http-client

Packages install from a zip of the tag’s commit, made the first time anyone asks for it and kept from then on. Files the repository’s .gitattributes marks export-ignore, such as tests, are left out of it, as git archive leaves them out. --prefer-source clones from g1t.sh instead.

Private packages

A package has its repository’s visibility and roles: Read installs it. For a private one, give Composer your username and an access token (one with full access, or with packages:read and code:read, so that --prefer-source can clone too):

composer config --global --auth http-basic.g1t.sh <you> <token>

That writes ~/.composer/auth.json, which stays out of the project. A Bearer token works as well (bearer.g1t.sh). Without credentials, a workspace’s repository lists only its public packages.

In workflows

A workflow’s G1T_TOKEN can install the workspace’s private packages:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: composer config --global --auth http-basic.g1t.sh g1t "$G1T_TOKEN"
        env:
          G1T_TOKEN: ${{ secrets.G1T_TOKEN }}
      - run: composer install --no-interaction

Limits

A zip is made of at most 10,000 files and 64 MB; a larger commit installs from source (composer install --prefer-source). A package lists its newest 300 version tags and 50 branches. Zips count toward the workspace’s package storage, as other packages do (see storage and pull limits).