Fix dependency scoping with auto-downloaded composer

[Copilot]

• Resolves: Deleting feeds removes Starred articles #3418

Summary

The PHP dependency scoping process failed when using auto-downloaded composer because the scope-dependencies script deleted the build/ directory containing the downloaded composer.phar before completing.

Changes:

• Makefile: Moved composer download location from build/tools/ to .tools/ to isolate it from build artifacts
• composer.json: Reordered scope-dependencies script to defer build/ cleanup until after scoping completes; switched to @composer --working-dir syntax
• scoper.inc.php: Added fallback logic to detect and use .tools/composer.phar when no global composer exists
• .gitignore: Added .tools/ directory

The fix maintains compatibility with both global and auto-downloaded composer installations.

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Changelog entry added for all important changes.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Dependency scoping incompatible with auto-downloaded composer</issue_title>
<issue_description># IMPORTANT

Read and tick the following checkbox after you have created the issue or place an x inside the brackets ;)

• I have read the CONTRIBUTING.md and followed the provided tips
• I accept that the issue will be closed without comment if I do not check here
• I accept that the issue will be closed without comment if I do not fill out all items in the issue template.

Explain the Problem

Since the implementation of the PHP dependency scoping (#3397), it's not possible to build the app using the automatically downloaded composer.
The Makefile installs the latest version of composer into the build/tools directory if no global installation was found.

Command line output

user@domain:/var/www/nextcloud/apps/news$ make
make composer
make[1]: Entering directory '/var/www/nextcloud/apps/news'
No composer command available, downloading a copy from the web
mkdir -p "/var/www/nextcloud/apps/news/build/tools"
curl -sS https://getcomposer.org/installer | php
All settings correct for using Composer
Downloading...

Composer (version 2.9.2) successfully installed to: /var/www/nextcloud/apps/news/composer.phar
Use it: php composer.phar

mv composer.phar "/var/www/nextcloud/apps/news/build/tools"
rm -rf vendor/
php "/var/www/nextcloud/apps/news/build/tools/composer.phar" install --prefer-dist --no-dev
Installing dependencies from lock file
Verifying lock file contents can be installed on current platform.
Package operations: 18 installs, 0 updates, 0 removals
  - Installing bamarni/composer-bin-plugin (1.8.3): Extracting archive
  - Installing php-http/discovery (1.20.0): Extracting archive
  - Installing arthurhoaro/favicon (v2.0.1): Extracting archive
  - Installing masterminds/html5 (2.10.0): Extracting archive
  - Installing psr/http-message (2.0): Extracting archive
  - Installing psr/http-factory (1.1.0): Extracting archive
  - Installing league/uri-interfaces (7.5.0): Extracting archive
  - Installing league/uri (7.5.1): Extracting archive
  - Installing fivefilters/readability.php (v3.3.3): Extracting archive
  - Installing ralouphie/getallheaders (3.0.3): Extracting archive
  - Installing guzzlehttp/psr7 (2.8.0): Extracting archive
  - Installing psr/http-client (1.0.3): Extracting archive
  - Installing php-http/promise (1.3.1): Extracting archive
  - Installing php-http/httplug (2.4.1): Extracting archive
  - Installing php-http/guzzle7-adapter (1.1.0): Extracting archive
  - Installing nyholm/psr7 (1.8.2): Extracting archive
  - Installing php-feed-io/feed-io (v6.2.0): Extracting archive
  - Installing symfony/html-sanitizer (v7.3.6): Extracting archive
Generating autoload files
[bamarni-bin] The setting "extra.bamarni-bin.bin-links" will be set to "false" from 2.x onwards. If you wish to keep it to "true", you need to set it explicitly.
[bamarni-bin] The setting "extra.bamarni-bin.forward-command" will be set to "true" from 2.x onwards. If you wish to keep it to "false", you need to set it explicitly.
6 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
php "/var/www/nextcloud/apps/news/build/tools/composer.phar" scope-dependencies
sh: 1: composer: not found
Script cd vendor-bin/php-scoper && composer install --ignore-platform-reqs --no-interaction handling the scope-dependencies event returned with error code 127
make[1]: *** [Makefile:82: composer] Error 127
make[1]: Leaving directory '/var/www/nextcloud/apps/news'
make: *** [Makefile:68: build] Error 2

I've figured out how to fix the installation issue inside the composer script but got stuck on the following ones.

diff --git a/composer.json b/composer.json
index c0ee1376a..6e01f5680 100644
--- a/composer.json
+++ b/composer.json
@@ -94,7 +94,7 @@
   },
   "scripts": {
     "scope-dependencies": [
-      "cd vendor-bin/php-scoper && composer install --ignore-platform-reqs --no-interaction",
+      "@composer install --working-dir=vendor-bin/php-scoper --ignore-platform-reqs --no-interaction",
       "rm -Rf build",
       "vendor-bin/php-scoper/vendor/bin/php-scoper add-prefix --force",
       "rm -Rf lib/Vendor",

Since the 3rd line removes the entire build directory, the contained tools dir with the downloaded composer is also gone.
But even without it, the 4th line with the php-scoper call then can't find the composer even when prefixed with @composer exec.

As a side note: always nuking the downloaded packages and therefore forcing to redownload everything for every single build seems kinda unnecessary. Maybe there is another solution?
https://github.com/nextcloud/news/blob/7ff338d...

• Fixes Dependency scoping incompatible with auto-downloaded composer #3492

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.