- How do I install tm/tooly-composer-script in a Laravel project?
- Install it as a dev dependency with Composer, for example composer require --dev tm/tooly-composer-script. Keep it in require-dev because it is a build-time Composer script handler, not a runtime Laravel package. Commit composer.json and composer.lock, then register your script classes in the scripts section. Validate the exact version on your PHP and Composer matrix before rolling it out.
- Does tm/tooly-composer-script work with PHP 8 and Composer 2?
- The available context does not confirm PHP 8 or Composer 2 support; the 1.4.1 patch only fixes checksum generation. Treat compatibility as unproven until you run a time-boxed proof of concept on your oldest and newest supported PHP and Composer versions. Pin the exact version and commit the lockfile, and re-validate any future patch release.
- How do I register a PHP script class in composer.json with Tooly Composer Script?
- Add a Composer script entry that points to the package handler and your script class, following the package README for the exact syntax. The goal is to keep automation in reusable, testable PHP classes rather than long inline shell command strings. Keep the old command available until the new script reaches parity.
- Can I use tm/tooly-composer-script in CI pipelines?
- Yes, conceptually it fits CI because it runs through Composer and keeps local and pipeline tasks consistent. For PHAR builds, ensure ext-phar is enabled, phar.readonly=0 is set in CI, and OpenSSL is available if you sign artifacts. Verify checksums independently rather than relying only on a successful build. Pin versions in CI so floating upgrades do not break releases silently.
- What is the difference between this package and inline Composer scripts?
- Inline Composer scripts are convenient but become brittle as shell commands grow, especially across Windows, Linux, and CI environments. tm/tooly-composer-script lets you move that logic into PHP classes that are reusable, testable, and easier to maintain. It keeps composer.json cleaner and reduces duplication across local workflows and pipelines. It is still a Composer-level tool, so it does not add runtime coupling to your Laravel app.
- Is tm/tooly-composer-script safe for production use?
- It is a build-time tool, so risk is usually contained to your release pipeline rather than production traffic. However, the project has low community validation, with about 103 stars and zero dependents, and a single 1.4.1 checksum fix is not evidence of sustained maintenance. Use it as a pinned dev dependency with internal ownership, and have a fallback to humbug/box or a native Phar build script. Do not introduce it into runtime dependencies.
- How do I build a PHAR with a checksum using Tooly Composer Script?
- The package is suited to producing a PHAR artifact from a Laravel or PHP CLI project as an isolated build step. Version 1.4.1 fixes checksum generation, so pin at 1.4.1 or later and avoid older versions that would bake the defect into released artifacts. Independently compute and compare the checksum downstream, not just confirm that the build succeeded. Confirm who consumes the artifact and whether they verify checksums.
- What are alternatives to tm/tooly-composer-script for building PHARs?
- humbug/box is the better-known, better-supported alternative for PHAR creation. A short custom Phar build script using PHP built-in Phar extension is another straightforward option. Because tm/tooly-composer-script is not embedded in application code, migrating away is relatively easy. Choose based on your need for signing, reproducible builds, and CI artifact attestation.
- Does tm/tooly-composer-script require a Laravel service provider?
- No. It is a Composer script handler, not a Laravel runtime package, so there is no service provider to register. It belongs in require-dev and is wired through composer.json scripts. That keeps application-level coupling low and makes it appropriate for CLI tooling, internal binaries, or small distributable console applications.
- Is tm/tooly-composer-script actively maintained and who owns it if abandoned?
- The context does not show strong maintenance signals: low stars, zero dependents, a low score, and 1.4.1 as a narrow checksum fix. Treat long-term maintenance as a medium-to-high risk and assign an internal owner for the build script. If the package is abandoned, migrate to humbug/box or a native Phar script. MIT licensing is acceptable, but inspect dependencies during review.