scagogogo/composer-skills

# Composer Skills [](https://pkg.go.dev/github.com/scagogogo/composer-skills) [](https://goreportcard.com/report/github.com/scagogogo/composer-skills) [](https://github.com/scagogogo/composer-skills/actions/workflows/go-tests.yml) [](LICENSE) [简体中文](README-zh-CN.md) · **English** Go module: `github.com/scagogogo/composer-skills` · License: MIT · Go ≥ 1.23 针对 PHP Composer 生态系统的强类型 Go SDK。只需一次导入即可暴露两个独立的 SDK 以及一个基础层。无需解析 `exec.Command` 输出——所有结果均为 Go structs。 ## 包 | 导入路径 | 角色 | 是否需要 PHP | |---|---|---| | `pkg/client` | Packagist REST API 客户端（20 个方法） | 否 | | `pkg/repository` | 底层 Packagist HTTP 层（支持 `context`） | 否 | | `pkg/composer` | Composer CLI 包装器（234 个方法，20 个类别） | 是（PHP 7.4+，Composer 2.0+） | | `pkg/detector` | 跨操作系统 Composer 二进制文件检测 | 否 | | `pkg/installer` | 自动安装 Composer + PHP（Windows/macOS/Linux） | 否 | | `pkg/domain` | 数据模型（`Package`、`Advisory`、`Statistics`、`Version` 等） | 否 | | `pkg/composerutils` | 文件系统 / HTTP / mock / 测试辅助工具 | 否 | | `cmd/composer-skills` | 暴露所有 SDK 功能的 Cobra CLI（50+ 子命令） | 混合 | ## 选择 SDK - 查询 packagist.org（搜索、统计、安全公告、包信息）→ `pkg/client`。纯 Go 实现，无需 PHP。 - 操作本地 PHP 项目（安装/更新/依赖/审计/验证）→ `pkg/composer`。需要在主机上安装 PHP+Composer。 - 检测是否已安装 Composer → `pkg/detector`。如果缺失则进行安装 → `pkg/installer`。 ## 安装 ``` go get github.com/scagogogo/composer-skills ``` ## Packagist API（无需 PHP） ``` package main import ( "fmt" "time" "github.com/scagogogo/composer-skills/pkg/client" ) func main() { c := client.NewComposerClient(30 * time.Second) r, _ := c.SearchPackages("logging", 10, 1) fmt.Println("matches:", r.Total) p, _ := c.GetPackage("monolog/monolog") fmt.Println(p.Package.Name, "—", p.Package.Description) a, _ := c.GetSecurityAdvisories() fmt.Println("advisories:", len(a.Advisories)) s, _ := c.GetStatistics() fmt.Println("total packages:", s.Packages) } ``` ## Composer CLI（需要 PHP + Composer） ``` package main import ( "fmt" "log" "github.com/scagogogo/composer-skills/pkg/composer" ) func main() { comp, err := composer.New(composer.DefaultOptions()) // auto-installs Composer if missing if err != nil { log.Fatal(err) } comp.SetWorkingDir("/path/to/php/project") _ = comp.Install(false, true) _ = comp.RequirePackage("monolog/monolog", "^3.0", false) _ = comp.Update([]string{}, false) audit, _ := comp.AuditWithJSON() // typed security audit fmt.Println("vulns:", audit.Found) outdated, _ := comp.GetOutdatedInfo() // typed outdated info fmt.Println("outdated:", len(outdated.Outdated)) _ = comp.ValidateStructured() // validate composer.json phpVer, _ := comp.GetPHPVersion() hasExt, _ := comp.HasExtension("mbstring") fmt.Println(phpVer, hasExt) } ``` ## 自动安装 Composer ``` package main import ( "fmt" "github.com/scagogogo/composer-skills/pkg/detector" "github.com/scagogogo/composer-skills/pkg/installer" ) func main() { d := detector.NewDetector() if d.IsInstalled() { path, _ := d.Detect() fmt.Println("found:", path) return } inst := installer.NewInstaller(installer.SmartConfig()) fmt.Println(inst.Install()) // downloads Composer (+ PHP if needed), OS-aware } ``` ## 结构化结果方法 优先使用这些方法而不是原始字符串变体——它们会将 `composer ... --format=json` 解析为 Go structs。 | 方法 | 返回值 | 包装命令 | |---|---|---| | `AuditWithJSON` | `*AuditResult` | `composer audit --format=json` | | `GetOutdatedInfo` | `*OutdatedResult` | `composer outdated --format=json` | | `GetVersionInfo` | `*VersionInfo` | `composer --version` | | `ShowPackageInfo` | `*PackageInfo` | `composer show --format=json` | | `SearchInfo` | `*SearchResult` | `composer search --format=json` | | `ValidateStructured` | `*ValidateResult` | `composer validate` | | `CheckPlatformReqsStructured` | `*PlatformCheckResult` | `composer check-platform-reqs` | | `GetLicensesInfo` | `*LicensesResult` | `composer licenses` | | `GetConfigStructured` | `*ConfigResult` | `composer config` | | `DiagnoseStructured` | `*DiagnoseResult` | `composer diagnose` | ## 便捷辅助方法 `IsPackageInstalled`, `IsPackageDev`, `HasComposerLock`, `HasVendorDir`, `GetInstalledPackageNames`, `GetDirectDependencyNames`, `GetProjectDependencies`, `GetProjectSummary`, `GetRequireWithVersion`, `GetAbandonedPackagesFromLock`, `GetNamespaceMap`, `GetScripts`, `GetVendorDir`, `GetCacheDir`, `GetComposerHomeDir`。 ## CLI ``` go install github.com/scagogogo/composer-skills/cmd/composer-skills@latest ``` ``` composer-skills search query "logging" # Packagist (no PHP) composer-skills package info symfony/console --json composer-skills security advisories composer-skills repo stats composer-skills repo popular composer-skills local install --working-dir /path/to/project # Composer (needs PHP) composer-skills local audit --working-dir /path/to/project composer-skills local outdated --working-dir /path/to/project composer-skills local why monolog/monolog --working-dir /path/to/project ``` 全局 flags：`--timeout`（默认 60s）、`--base-url`、`--repo-url`、`--username`、`--api-token`、`--json`。 ## Composer CLI 方法分类（234 个方法） Core (10) · Dependencies (16) · Packages (20) · Audit (10) · Project (10) · Config (12) · Validation (14) · Platform (8) · Repository (18) · Global (14) · Auth (10) · Fund (7) · Licenses (4) · Diagnosis (8) · Exec (8) · Satis (8) · Version (5) · Environment (12) · composer.json (10) · Archive (6)。 命名约定：每个操作都有一个基础方法、一个 `WithOptions(map[string]string)` 变体，以及在 Composer 支持 `--format` 的情况下的一个 `WithFormat(format)` 变体。结构化变体命名为 `XxxInfo` / `XxxStructured` / `XxxWithJSON`。 ## 项目结构 ``` cmd/composer-skills/ CLI (Cobra, 50+ subcommands) pkg/client/ Packagist API client pkg/repository/ Low-level Packagist HTTP layer pkg/composer/ Composer CLI wrapper SDK pkg/detector/ Composer detection (cross-OS) pkg/installer/ Composer + PHP auto-install pkg/domain/ Data models pkg/composerutils/ Filesystem / HTTP / mock / test helpers examples/ 15+ runnable programs docs/skills/ Progressive guides (12) website/docs/ VitePress docs site ``` ## 测试 ``` make test # all tests make test-race # with race detector make test-coverage # coverage report ``` 包含 450+ 个测试，通过 `pkg/composerutils/mock` 和 `composer.SetupMockOutput` 实现基于 mock 的隔离。 ## 文档 - 文档网站：https://scagogogo.github.io/composer-skills/ - Go 参考：https://pkg.go.dev/github.com/scagogogo/composer-skills - 示例：`examples/` 目录 ## AI 提示词 将下方的代码块复制到您的 AI 对话（ChatGPT、Claude、Copilot 等）中，让它为您集成此 SDK。请将括号中的内容替换为您具体的实际目标。 ``` # 任务：将 `composer-skills` 集成到 Go 项目中 You are integrating **Composer Skills** — `github.com/scagogogo/composer-skills`, a typed Go SDK for the PHP Composer ecosystem. Go ≥ 1.23, MIT. ## 两个独立的 SDK 1. `pkg/client` — Packagist REST API. Pure Go, no PHP. Methods: `SearchPackages`, `GetPackage`, `GetSecurityAdvisories`, `GetStatistics`, `ListPackages*`, `GetPackageStats`, `CreatePackage`/`EditPackage`/`UpdatePackage` (need `WithAPICredentials`). Construct: `c := client.NewComposerClient(30*time.Second)`. 2. `pkg/composer` — typed wrapper over the local `composer` binary. Needs PHP 7.4+ + Composer 2.0+. Construct: `comp, err := composer.New(composer.DefaultOptions())` (auto-installs Composer if missing). 234 methods across 20 categories. Foundation: `pkg/detector` (cross-OS Composer detection, `NewDetector().Detect()`), `pkg/installer` (auto-install Composer+PHP, `installer.NewInstaller(installer.SmartConfig()).Install()`), `pkg/domain` (data models), `pkg/composerutils` (fs/http/mock/test helpers). ## 规则 - Prefer structured methods returning Go structs: `AuditWithJSON`, `GetOutdatedInfo`, `GetVersionInfo`, `ShowPackageInfo`, `SearchInfo`, `ValidateStructured`, `CheckPlatformReqsStructured`, `GetLicensesInfo`, `GetConfigStructured`, `DiagnoseStructured`. Avoid parsing raw string output. - Each operation has base, `WithOptions(map[string]string)`, and (where Composer supports) `WithFormat(format)` variants. - Convenience helpers: `IsPackageInstalled`, `GetDirectDependencyNames`, `GetProjectSummary`, `GetAbandonedPackagesFromLock`, `GetNamespaceMap`, `GetScripts`, `HasComposerLock`, `HasVendorDir`. - CLI: `go install github.com/scagogogo/composer-skills/cmd/composer-skills@latest` — 50+ subcommands (`search`, `package`, `repo`, `security`, `local`, …), `--json` flag, `--working-dir` for local ops. - Docs: https://scagogogo.github.io/composer-skills/ · Go ref: https://pkg.go.dev/github.com/scagogogo/composer-skills · Examples: `examples/`. ## 我的目标 [Replace this line with what you want to build, e.g. "a Go service that nightly scans all my PHP projects for vulnerable dependencies and alerts Slack."] Deliver: (1) which SDK and why, (2) complete runnable Go code with imports + error handling, (3) `go get` command + environment prerequisites, (4) relevant doc links. ``` ## 致谢 - [Packagist](https://packagist.org/) — PHP 包仓库 - [Composer](https://getcomposer.org/) — PHP 依赖管理器 ## 许可证 [MIT](LICENSE)

标签：Composer, EVTX分析, Go模块, OpenVAS, Packagist API, PHP, SOC Prime, 开发工具, 日志审计, 服务器监控, 特权提升, 自动化部署