Fix dependency issues

I'm hesitant about adding the version key. This might be a different alternative to solve this issue #3035459: Dependencies cause error while Social Post version has no stable release

This is a chicken and egg problem. The Drupal.org packaging script injects your module version key into an info.yml file. However this only happens for a stable package versions.

Hopefully this documentation will help the discussion.

For modules hosted on drupal.org, the version number will be filled in by the packaging script. You should not specify it manually, but leave out the version line entirely.

Note that if your module has dependencies on other contributed modules or libraries, these should be declared in the module's composer.json file.

Let Drupal 8 know about your module with an .info.yml file

If a module developer wishes to use the more expressive constraints provided by composer.json ... those are only possible in composer.json. (Though drupal itself will not be bound by those constraints, they will only be respected at build time, if the end user is using composer to build their site)

Regardless of whether or not a developer has a composer.json file, their drupal module dependencies must still be expressed in their .info.yml files so that drupal can ensure that the correct modules are enabled.

Add a composer.json file

Some notes of my own:

Steps for manually downloading modules for install are still officially documented, however they aren't recommended for non-stable / or non-recommended versions.

Drush 9 no-longer supports manually downloading and installing modules without composer.json
Drush 9 is required for use with currently supported Drupal 8 versions. Drupal 8.5 is the oldest supported version today.

If we choose to manually add a version string into the info.yml we should have a process in place to remove it whenever a stable, recommended release version is tagged, so it isn't conflicting with the Drupal.org packaging script.

Let's fix the issue with Social Auth Google at #3030876: Dependencies cause error while Social Auth has no stable release

In the documentation page for Alpha releases here https://www.drupal.org/node/1068944

It says:

Note that the process for development releases has recently changed.

That page was updated only a few days ago. Can I also suggest just checking that the releases set-up for each of the modules.

The Drupal.org packaging script should create distributions for 8.x-2.x-dev that contain version information like this, but maybe they're not working for some reason.

name: Social Post
type: module
description: Allows posting content to different social networks automatically
# core: 8.x
package: Social
configure: social_post.integrations
dependencies:
  - social_api:social_api (>= 8.x-2.x)

# Information added by Drupal.org packaging script on 2018-11-23
version: '8.x-2.0-beta2+5-dev'
core: '8.x'
project: 'social_post'
datestamp: 1542935886

You see above, it counts the number commits that the dev branch is ahead of the last recommended release and creates a version number as:

version: '8.x-2.0-beta2+5-dev'

Worth just checking that this is working for all dependencies in this module pack.

I looks like this module, Social Auth is working okay:

Last updated: 4 Feb 2019 at 05:48 AEDT
Last packaged version: 8.x-2.0-beta4+22-dev

https://www.drupal.org/project/social_auth/releases?api_version[]=7234

I also downloaded the module tarball and it had this:

name: Social Auth
type: module
description: Allows user authentication with different services.
# core: 8.x
package: Social
configure: social_auth.integrations
dependencies:
  - social_api:social_api (>= 8.x-2.x)

# Information added by Drupal.org packaging script on 2019-02-03
version: '8.x-2.0-beta4+22-dev'
core: '8.x'
project: 'social_auth'
datestamp: 1549219689

So versions are being packed in properly for this module.

Does this mean we don't need to make the changes in my last patch?

I think the changes in patch #7 are more in line with the Drupal standards if I'm not mistaken.