composer create project drupal/core-recommended:version should get the exact version specified

Maybe we should change the template projects themselves to contain `~8.8.0`, `~8.9.0`, etc.; that way, if someone runs `composer create-project drupal/recommended-project:~8.8.0`, then they will get the latest `8.8.x` version of drupal/recommended-project, which will also also have `drupal/core-recommended:~8.8.0` as a dependency. If on the other hand they use `^8.8` instead of `~8.8.0` with `create-project`, then they will get the latest 8.x release of drupal/recommended-project, which will be 8.9.0 (if not today, imagine some point in the future when it will), which will have `drupal/core-recommended:~8.9.0`. This would be fairly consistent with how Composer is expected to behave.

The odd part is if someone tries to run `composer create-project drupal/recommended-project:8.7.5` in an attempt to specifically pin drupal/core-recommended to a specific version, then they will still get `drupal/core-recommended:~8.8.0` in their resulting project, because that's what is in every 8.8.x version of the template.

Our other option would be to add a composer post-create-project script to fix up the composer.json of the resulting project after the fact (and then remove itself). However, I am not sure that it's easy to get the constraint the user provided on the create-project commandline at post-create-project time, and in general I am wary about doing that much work to change the basic behavior of Composer. Perhaps we should be satisfied with what we can do with standard features and document the behavior.

During the DrupalCon Amsterdam contribution sprint, it was discussed that adding a code-based solution was not advantageous for a few reasons. It would be necessary to somehow pass the core version from `composer -n create-project drupal/recommended-project:VERSION` to the require section in order to specify the exact version of drupal/core-recommended. There is no native/easy way to do this with Composer. We discussed possibly doing this via a Composer hook or via a .env file, but neither potential solution was very elegant or Composer-y. Therefore, marking this issue as "Closed (won't fix)".

The current consensus is to provide documentation for users on how to specify an exact version of Drupal core, when necessary.

For example, to use drupal/recommended-project to install the latest stable version of Drupal core, use (once Drupal 8.8 is released):

`composer -n create-project drupal/recommended-project:~8.8.0 my-project`

Similarly, if you want to install the latest dev version (once #3091581: Create generator scripts to customize drupal/recommended-project and drupal/legacy-project per minor Drupal version lands):

`composer -n create-project drupal/recommended-project:~8.8.0@dev my-project`

or

`composer -n create-project drupal/recommended-project:~8.9.0@dev my-project`

**Note to self, check #??? to see if/when a change is made to drupal/recommended project where dependency versions track with the branch.

If you would like to install a specific version of Drupal core for versions prior to 8.8.0,

`composer -n create-project drupal/recommended-project:8.7.5 --no-install my-project; cd my-project; composer require drupal/core-recommended:8.7.5 drupal/core-dev:8.7.5 --update-with-dependencies`

Once #3091579: Remove core-dev from drupal/recommended-project Composer template lands, `drupal/core-dev` doesn't need to be included.

In the future, as maintenance releases of 8.8 are released, the following would be used for a specific 8.8.x version:

`composer -n create-project drupal/recommended-project:8.8.2 --no-install my-project; cd my-project; composer require drupal/core-recommended:8.8.2 drupal/core-dev:8.8.2 drupal/core-composer-scaffold:8.8.2 --update-with-dependencies`

#5 does not actually help.

... composer create-project drupal/recommended-project:8.7.5 would give us the exact right version of core specified and not whatever the newest one was.

That is not the case. When you run composer create-project drupal/recommended-project:8.7.5, you will get version 8.7.5 of the core-recommended-project. However, all versions of Drupal core-recommended contain drupal/core-recommended: ^8.8. Even if we change this to drupal/core-recommended:~8.8.0 or druapl/core:~8.8.0, the basic behavior will be the same: the version of drupal/core will float.

What we could do is put drupal/core-recommended: 8.7.5 in the 8.7.5 version of drupal/recommended-project. That would make the create-project behave exactly as expected when installing a tag. Unfortunately, it would prevent upgrades for users who were asking for drupal/core-recommended:^8.8, so that solution is no good either.

In order for things to work right for all scenarios, we need the version used on the command line to be copied into the resulting project's composer.json file. The fact that Composer does not provide a facility to do that by default is the crux of the problem.

Yeah, I forgot about the composer.lock angle. We should try that.

The way we should tell people to get a specific version of core using templates is as follows:

$ composer create-project drupal/recommended-project myproject 8.8.*
$ cd myproject
$ composer require core/recommended 8.8.0 --update-with-all-dependencies

Here's a variation that works with current releases (we're at beta1):

$ composer create-project -s dev drupal/recommended-project myproject 8.8.*
# See:   - Installing drupal/core-recommended (8.8.0-beta1)
$ cd myproject/
$ composer require drupal/core-recommended:8.8.0-alpha1 --update-with-all-dependencies
# See:   - Downgrading drupal/core-recommended (8.8.0-beta1 => 8.8.0-alpha1)

Now the user understands how these pieces work together, and understands how they can get updates to core by either requiring the specific patch version, or changing to ~8.8.

Adding a lock file and all that other stuff only complicates matters unnecessarily.

Btw, just tested composer create-project drupal/recommended-project:^8.9 myproject to download Drupal 8.9.1

It seems working like a charm so far.

This was fixed in the Drupal.org infrastructure subtree splitter, subtree-splitter#2.