composer manager does not take into account "installer-paths" for wordpress plugins

[paulo-dc]

How are you running Renovate?

in gitlab-ci job, or locally with docker image.

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

gitlab, latest

Please tell us more about your question or problem

Hello, I'm trying to configure renovate to keep our project up to date. We use wordpress, and want to keep also up to date wordpress plugins. We installed the plugins in the folder wp-content/plugins with composer.

But when we run renovate, it installs the plugins in the folder "vendor" 😓 .

I searched a lot through renovate docs, and internet, and did many many tries unsuccefully. Could you please help me.

I has already reproduce the issue on a minimal github repo. I will rename the minimal repo with the issue ID, and add a comment and link with it.

Tx

Logs (if relevant)

Logs

DEBUG: Executing command (branch="renovate/yoast-wordpress-seo-23.x-lockfile")
{
  "command": "composer update yoast/wordpress-seo:23.7 --with-dependencies --ignore-platform-req='ext-*' --ignore-platform-req='lib-*' --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins"
}

DEBUG: exec completed (branch="renovate/yoast-wordpress-seo-23.x-lockfile")
{
  "durationMs": 1895
  "stdout": ""
  "stderr": "Loading composer repositories with package information\nDependency composer/installers is also a root requirement. Package has not been listed as an update argument, so keeping locked at old version. Use --with-all-dependencies (-W) to include root dependencies.\nUpdating dependencies\nLock file operations: 0 installs, 1 update, 0 removals\n  - Upgrading yoast/wordpress-seo (23.6 => 23.7)\nWriting lock file\nInstalling dependencies from lock file (including require-dev)\nPackage operations: 2 installs, 0 updates, 0 removals\n  - Downloading wpackagist-plugin/advanced-access-manager (6.9.41)\n  - Downloading yoast/wordpress-seo (23.7)\n  - Installing wpackagist-plugin/advanced-access-manager (6.9.41): Extracting archive\n  - Installing yoast/wordpress-seo (23.7): Extracting archive\n1 package you are using is looking for funding.\nUse the `composer fund` command to find out more!\nNo security vulnerability advisories found.\n"
}

DEBUG: Returning updated composer.lock (branch="renovate/yoast-wordpress-seo-23.x-lockfile")
DEBUG: Committing vendor files in vendor (branch="renovate/yoast-wordpress-seo-23.x-lockfile")
DEBUG: Updated 1 package files (branch="renovate/yoast-wordpress-seo-23.x-lockfile")
DEBUG: Updated 1588 lock files (branch="renovate/yoast-wordpress-seo-23.x-lockfile")
{
  "updatedArtifacts": [
    "composer.lock",
    "vendor/composer/installed.json",
    "vendor/composer/installed.php",
    "vendor/wpackagist-plugin/advanced-access-manager/aam.php",
    "vendor/wpackagist-plugin/advanced-access-manager/application/Addon/Repository.php",
    "vendor/wpackagist-plugin/advanced-access-manager/application/Audit/AuditCheckTrait.php",
    "vendor/wpackagist-plugin/advanced-access-manager/application/Audit/CoreUserRoleOptionIntegrityCheck.php",
    "vendor/wpackagist-plugin/advanced-access-manager/application/Audit/EditableFileSystemCheck.php",
    "vendor/wpackagist-plugin/advanced-access-manager/application/Audit/ElevatedCoreRoleCheck.php",

[paulo-dc]

Minimal reproduction here : https://github.com/paulo-dc/minimal-reproduction-32108

[rarkins]

Please install the bot into this repo. I assume that it's expected to generate a "wrong" PR?

[paulo-dc]

Arg, sry, did too much cleanning 😅. Repaired, bot installed and "wrong" PR created by the bot.

[rarkins]

What is "a deepcheck"?

[paulo-dc]

Sorry Rhys, it is just the name of our gitlab-ci job running renovate. my bad. Didn't whant to confuse you.

[rarkins]

Please update the description so that it doesn't confuse others too

[paulo-dc]

Done.

[rarkins]

It's composer itself which is installing those files to vendor. Normally how does it know to install into wp-content/plugins instead?

[paulo-dc]

Sorry Rhys, didn't catch you. What do you mean with "no scripts/plugins" ?

[rarkins]

This is the command which is run: composer update yoast/wordpress-seo:23.7 --with-dependencies --ignore-platform-req='ext-*' --ignore-platform-req='lib-*' --no-ansi --no-interaction --no-scripts --no-autoloader --no-plugins. I assume that one of these flags might be causing it to skip your extras instruction

[paulo-dc]

Ah !!!!! Ok 😳 !!! many thanks Rhys 😀 , I will look after that and try to reproduce it !

[paulo-dc]

Many thanks Rhys, with the env variable RENOVATE_ALLOW_PLUGINS=true now wordpress plugins are in the chosen path 😀.
The option --no-plugins is removed from the command line.

Unfortunatly I have still a strange issue : on the renovate branches for the PRs, only deleted files are commited! No untracked or changed files. It's strange, do you have an idea why ?

for info, when I run the exact same command renovate uses for compser, there is not only deleted files, but also new files and manay changed files.

[paulo-dc]

As it is a different question, I'll create a new issue. sry for that.

Anyway thank you very much, My first question is solved 😀

[github-actions[bot]]

Hi there,

Please stick to one topic/question per Discussion. Start a new discussion per topic.

This prevents future users from finding this discussion and getting confused by multiple questions and answers. One question and answer per Discussion works best.

For example:

• Don't create a discussion with multiple questions requiring multiple answers
• If you got an answer to your first question, don't change topic like "Can I also ask you how I might..." which would then require a different answer. Mark the current discussion as answered and open a new one.

Thanks, the Renovate team