Skip to content

Docs: explain how to block packages #128

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions docs/setup.md
Original file line number Diff line number Diff line change
Expand Up @@ -187,6 +187,26 @@ Alternatively you may submit an array of packages to define multiple versions:
]
```
Once a custom package has been added to Private Packagist you will benefit from mirroring the zip file. Composer will have an additional location to download the file from if the original storage becomes unavailable.

### Prevent a package from being used with custom packages

While there is no direct "block package" feature in Packagist, you can effectively prevent a specific package from being used in your project by creating a placeholder package.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

instead of saying project we could generalize it and say Composer repository? Or (sub-)organization?
Project (for me) is really just a package with a composer.json + .lock file

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd suggest "your Composer project" then? It's about blocking usage in your codebase, not in the Private Packagist org/repository?


The package type [metapackage](https://getcomposer.org/doc/04-schema.md#type) ensures no code is associated with it. Optionally, you can mark the package as [abandoned](https://getcomposer.org/doc/04-schema.md#abandoned) and, if needed, suggest an alternative.

```json
{
"name": "acme/blocked-package",
"version": "0.0.1",
"type": "metapackage",
"abandoned": "acme/other-package"
}
```

If necessary, make sure the package is added to all relevant suborganizations.

This placeholder package will prevent any other package with the same name from being mirrored automatically, effectively blocking the problematic package from being used in your projects.

## Add an artifact package

You can upload code archives via *Add Package -> Artifact*. Your uploaded archives need to contain a valid composer.json file in its root directory and must be of type zip, gz, or bz2. Once you upload your code archives, you can save the artifact package and use it in your organization.
Expand Down