Composer

My use of Composer, PHP's dependency manager, goes beyond require and update. At TUN2U, STCC and HSPI I've used it for code that isn't public too: private repositories with Satis, published packages, credentials in auth.json, and patches to third-party packages.

Private repositories and publishing

Not all code can be public. For private packages I set up repositories with Satis, so projects install and update them through Composer like any other dependency. In parallel I've published packages on Packagist, the PHP ecosystem's central repository, and distributed private packages through GitHub Packages, using the native integration with Git repositories.

Authentication for paid packages

Some commercial packages need credentials to download. I keep them in auth.json, out of the project's code, and integrate those flows into CI/CD pipelines without exposing sensitive information. At TUN2U that included Magento's package repository.

Patches without forks

When a third-party package has a bug and the fix hasn't been released, I apply the correction with cweagans/composer-patches, without maintaining a fork of the whole project: the patch lives in the project and Composer reapplies it on every install. It's helped me more than once to resolve production bugs while waiting for the official upstream release.