Error: dealerdirect/phpcodesniffer-composer-installer contains a Composer plugin which is blocked by your allow-plugins config.

[helgatheviking]

Problem/Motivation

My github action is terminating with an error.

My github action is calling composer install

      - name: "Install Composer dependencies with development dependencies."
        run: |
          composer install --no-interaction --prefer-dist --no-scripts

Currently the action appears to be installing composer 2.3.10.

My composer.json is only including woocommerce-sniffs which appears to require

"dealerdirect/phpcodesniffer-composer-installer": "^0.7.0",

Expected behaviour

composer install finishes without throwing exception that ends the github action

Actual behaviour

the action is failing with the following message:

Error: dealerdirect/phpcodesniffer-composer-installer contains a Composer plugin which is blocked by your allow-plugins config. You may add it to the list if you consider it safe.

the GH action log

Steps to reproduce

Building a release asset on git tag for plugin repo

{
   "name": "kathyisawesome/wc-not-sold-separately",
   "description": "Optionally restrict products to sale only as part of Mix and Match Product.",
   "homepage": "https://github.com/kathyisawesome/wc-not-sold-separately",
   "type": "wordpress-plugin",
   "license": "GPL-3.0-or-later",
   "require-dev": {
     "woocommerce/woocommerce-sniffs": "0.1.3"
   },
   "scripts": {
     "phpcs": [
         "phpcs . -s -p -n"
     ],
     "phpcs-pre-commit": [
       "phpcs . -s -p -n"
     ],
     "phpcb": [
         "phpcbf . "
     ]
   },
   "extra": {
     "scripts-description": {
           "phpcs": "Analyze code against the WordPress coding standards with PHP_CodeSniffer",
           "phpcb": "Fix coding standards warnings/errors automatically with PHP Code Beautifier"
     }
   }
 }

Proposed changes

(If you have a proposed change, workaround or fix, describe the rationale behind it)

Environment

Question	Answer
OS Ubuntu 20.04.4 LTS
PHP version	7.4
Composer version	7.4.30
PHP_CodeSniffer version	2.3.10
Composer PHPCS plugin version	0.7.10
Install type	Composer project local (i think?)
Output of vendor/bin/phpcs --config-show:

n/a - don't know how to access this in the GH action context

Tested against master branch?

• I have verified the issue still exists in the master branch.

If this is something known to be resolved in master then I will open a ticket with woocommerce/woocommerce-sniffs to update. I just wasn't sure where this issue originated so starting here.

[jrfnl]

@helgatheviking This is not an issue with this plugin, but with a "security feature" which was introduced in Composer 2.2. See this announcement post: https://blog.packagist.com/composer-2-2/#more-secure-plugin-execution

The Usage section of the readme contains all the info you need to solve this.

Nothing we can do about this, but you can fix it yourself by adding the permission. Hope this helps.

[helgatheviking]

Thanks so much @jrfnl . I still struggle with this ever since you got my plugin set up to run phpcs. :) I guess I don't understand the point of allow-plugins... by declaring a dependency I would think that I've already accepted I want that code to run.

Hopefully last question... can the woocommerce-sniffs repo add the config section in their composer.json or do I need to add it to mine for each project where I am using the woocommerce sniffs (which itself requires the dealerdirect/phpcodesniffer-composer-installer)

[jrfnl]

I guess I don't understand the point of allow-plugins...

Well, it was introduced as a security feature and while this plugin is quite innocent and limited in what it does (and therefore not problematic), there are other plugins which can make code changes in dependencies, so I can see how the allow-plugins feature could save someone's bacon who is not fully aware of the capabilities of each plugin dependency which was added.

can the woocommerce-sniffs repo add the config section in their composer.json or do I need to add it to mine for each project where I am using the woocommerce sniffs

The woocommerce-sniffs should also add the directive (for their own use), but you will still need to add it to your project as well. While require dependencies are inherited from your own require dependencies, the allow-plugins config is not.

Pro-tip for the woocommerce-sniffs standard: they should update their installation instructions to include the command to allow the plugin. See PHPCSStandards/PHPCSExtra#101 for an example.

[jrfnl]

@helgatheviking Can we close this issue as "answered" ?

[jrfnl]

@Potherca FYI: I've added this issue to the "pinned issues" and remove the pins related to Composer 2.x and PHP 8.0 as those are a bit dated by now.

[helgatheviking]

I'm cool with that. Thank you for the detailed explanation.