From 5176ca6748aecd78fb12652edfb4c20932a6277d Mon Sep 17 00:00:00 2001
From: Mike Little <mike@zed1.com>
Date: Thu, 21 May 2026 16:45:40 +0100
Subject: [PATCH] Add composer-config input to module CI

Sibling of module-config but operates on top-level composer.json keys
rather than extra.altis.modules. Callers pass a JSON object that is
shallow-merged into the test-root composer.json before the per-package
vcs entry is added.

Motivating case: altis/advanced-security depends on wpackagist-plugin/patchstack.
The wpackagist repository is not configured by altis/skeleton (kept that
way pending patchstack publication on Packagist proper). The previous
workflow had no way for the caller to inject the wpackagist source for
its own CI, so composer could not resolve the dep and the package-under-
test injection failed.

Now the caller can pass:

    composer-config: '{"repositories":{"wpackagist":{"type":"composer","url":"https://wpackagist.org"}}}'

Use object form (named keys), not array form, so the merged result coexists
with the auto-added `repositories.$ALTIS_PACKAGE` vcs entry composer adds
later in the same step.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/module-ci.yml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/.github/workflows/module-ci.yml b/.github/workflows/module-ci.yml
index c51e893..535b906 100644
--- a/.github/workflows/module-ci.yml
+++ b/.github/workflows/module-ci.yml
@@ -35,6 +35,10 @@ on:
         description: 'Optional JSON object merged into extra.altis.modules in the test-root composer.json. Used to enable opt-in module features for the CI run, e.g. ''{"media":{"private-media":true}}''.'
         default: ''
         type: string
+      composer-config:
+        description: 'Optional JSON object shallow-merged into the test-root composer.json at the top level. Use to inject keys like `repositories` for sibling deps not yet on Packagist, e.g. ''{"repositories":{"wpackagist":{"type":"composer","url":"https://wpackagist.org"}}}''. Pass repositories in object form (named keys), not array form, to coexist with the per-package vcs entry the workflow adds automatically.'
+        default: ''
+        type: string
     secrets:
       DOCKER_USERNAME:
         required: true
@@ -115,6 +119,7 @@ jobs:
         env:
           BASE_BRANCH: ${{ steps.base.outputs.base-branch }}
           MODULE_CONFIG: ${{ inputs.module-config }}
+          COMPOSER_CONFIG: ${{ inputs.composer-config }}
         shell: bash
         run: |
           set -euo pipefail
@@ -135,6 +140,16 @@ jobs:
             mv composer.json.tmp composer.json
           fi
 
+          # Shallow-merge any caller-provided composer config (top-level keys like `repositories`).
+          # Runs before the per-package vcs entry below so callers passing `repositories` in object
+          # form coexist with the auto-added `repositories.$ALTIS_PACKAGE` key.
+          if [[ -n "$COMPOSER_CONFIG" ]]; then
+            jq --argjson cfg "$COMPOSER_CONFIG" \
+              '. + $cfg' \
+              composer.json > composer.json.tmp
+            mv composer.json.tmp composer.json
+          fi
+
           # Use GitHub as the source for test to avoid packagist lag causing a race condition
           composer config "repositories.$ALTIS_PACKAGE" vcs "https://github.com/humanmade/altis-${ALTIS_PACKAGE#altis/}.git"