Dependency scoping incompatible with auto-downloaded composer

[anoymouserver]

IMPORTANT

Read and tick the following checkbox after you have created the issue or place an x inside the brackets ;)

• I have read the CONTRIBUTING.md and followed the provided tips
• I accept that the issue will be closed without comment if I do not check here
• I accept that the issue will be closed without comment if I do not fill out all items in the issue template.

Explain the Problem

Since the implementation of the PHP dependency scoping (#3397), it's not possible to build the app using the automatically downloaded composer.
The Makefile installs the latest version of composer into the build/tools directory if no global installation was found.

Command line output

user@domain:/var/www/nextcloud/apps/news$ make
make composer
make[1]: Entering directory '/var/www/nextcloud/apps/news'
No composer command available, downloading a copy from the web
mkdir -p "/var/www/nextcloud/apps/news/build/tools"
curl -sS https://getcomposer.org/installer | php
All settings correct for using Composer
Downloading...

Composer (version 2.9.2) successfully installed to: /var/www/nextcloud/apps/news/composer.phar
Use it: php composer.phar

mv composer.phar "/var/www/nextcloud/apps/news/build/tools"
rm -rf vendor/
php "/var/www/nextcloud/apps/news/build/tools/composer.phar" install --prefer-dist --no-dev
Installing dependencies from lock file
Verifying lock file contents can be installed on current platform.
Package operations: 18 installs, 0 updates, 0 removals
  - Installing bamarni/composer-bin-plugin (1.8.3): Extracting archive
  - Installing php-http/discovery (1.20.0): Extracting archive
  - Installing arthurhoaro/favicon (v2.0.1): Extracting archive
  - Installing masterminds/html5 (2.10.0): Extracting archive
  - Installing psr/http-message (2.0): Extracting archive
  - Installing psr/http-factory (1.1.0): Extracting archive
  - Installing league/uri-interfaces (7.5.0): Extracting archive
  - Installing league/uri (7.5.1): Extracting archive
  - Installing fivefilters/readability.php (v3.3.3): Extracting archive
  - Installing ralouphie/getallheaders (3.0.3): Extracting archive
  - Installing guzzlehttp/psr7 (2.8.0): Extracting archive
  - Installing psr/http-client (1.0.3): Extracting archive
  - Installing php-http/promise (1.3.1): Extracting archive
  - Installing php-http/httplug (2.4.1): Extracting archive
  - Installing php-http/guzzle7-adapter (1.1.0): Extracting archive
  - Installing nyholm/psr7 (1.8.2): Extracting archive
  - Installing php-feed-io/feed-io (v6.2.0): Extracting archive
  - Installing symfony/html-sanitizer (v7.3.6): Extracting archive
Generating autoload files
[bamarni-bin] The setting "extra.bamarni-bin.bin-links" will be set to "false" from 2.x onwards. If you wish to keep it to "true", you need to set it explicitly.
[bamarni-bin] The setting "extra.bamarni-bin.forward-command" will be set to "true" from 2.x onwards. If you wish to keep it to "false", you need to set it explicitly.
6 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
php "/var/www/nextcloud/apps/news/build/tools/composer.phar" scope-dependencies
sh: 1: composer: not found
Script cd vendor-bin/php-scoper && composer install --ignore-platform-reqs --no-interaction handling the scope-dependencies event returned with error code 127
make[1]: *** [Makefile:82: composer] Error 127
make[1]: Leaving directory '/var/www/nextcloud/apps/news'
make: *** [Makefile:68: build] Error 2

I've figured out how to fix the installation issue inside the composer script but got stuck on the following ones.

diff --git a/composer.json b/composer.json
index c0ee1376a..6e01f5680 100644
--- a/composer.json
+++ b/composer.json
@@ -94,7 +94,7 @@
   },
   "scripts": {
     "scope-dependencies": [
-      "cd vendor-bin/php-scoper && composer install --ignore-platform-reqs --no-interaction",
+      "@composer install --working-dir=vendor-bin/php-scoper --ignore-platform-reqs --no-interaction",
       "rm -Rf build",
       "vendor-bin/php-scoper/vendor/bin/php-scoper add-prefix --force",
       "rm -Rf lib/Vendor",

Since the 3rd line removes the entire build directory, the contained tools dir with the downloaded composer is also gone.
But even without it, the 4th line with the php-scoper call then can't find the composer even when prefixed with @composer exec.

As a side note: always nuking the downloaded packages and therefore forcing to redownload everything for every single build seems kinda unnecessary. Maybe there is another solution?

news/Makefile

Line 81 in 7ff338d

rm -rf vendor/

This issue is not a very high priority as there is the "workaround" to manually install composer globally. However, since the Makefile supports downloading the latest composer version, it has to work.

Steps to Reproduce

Explain what you did to encounter the issue

1. clone the repo
2. make sure no there is no global composer installation available
3. execute make build

System Information

• News app version: 28.0.0-beta.1
• Nextcloud version:
• Cron type: (system cron/python updater/...)
• PHP version: 8.4.16
• Database and version:
• Browser and version:
• OS and version: