Dependency management with DrupalCI

When DrupalCI builds the codebase for a project, It needs to be able to gather all of the dependencies that a project requires in order to be able to test those dependencies.

It can discover dependencies in two ways:

1. Rely packages.drupal.org to tell it what the dependencies are
2. Rely on a composer.json in the root of the project.

When we are testing a commit, The first method is sufficient for discovering the dependencies because the drupal.org packaging has figured out all of the dependencies from the composer.json and info.yml files in the project, however, this can only happen on drupal.org as part of the packaging process because it relies on the drupal.org database.

However when testing one of the following

• a change to the dependencies of a project
• a merge request for a project that has dependencies

we are only able to use a composer.json to inform us of what dependencies toe gather and make available for testing.

So for any project that has dependencies it is recommended to keep an accurate composer.json in the root of their project.

A projects' composer.json should express a dependency on drupal/core at a minimum.

Any optional dependencies that a module needs for testing should be expressed in the require-dev section of the composer.json