Composer's requiered packages not included in the zip archive with plugin-zip

[maeseoki]

Description

The script plugin-zip is not including composer's requiered packages to the final zip archive.
When you're developing a plugin that requires some composer's dependencies for production those are not included in the final zip archive. Can't belive I'm the first one facing this issue.
As I can see in the plugin-zip script, the only files/folder included in the package are the ones included in the Wordpress' Best Practices:

[
			'admin/**',
			'build/**',
			'includes/**',
			'languages/**',
			'public/**',
			`${ name }.php`,
			'uninstall.php',
			'block.json',
			'changelog.*',
			'license.*',
			'readme.*',
		]

Is there any way to solve this?
Perfect solution is to include somehow just the required packages and not the dev-required in the zip. A fast but lesser accurate is to include the vendor folder (but without modifying the script itself in node_modules wich is a problem for npm updates). And last but not least is to move composer's requiered packages to another folder, like includes.
¿Any ideas about this?

Step-by-step reproduction instructions

Create a plugin with, for example, npx create-block.
Then code your plugin and require a production dependency for php with composer (like chillerlan's qr-code)
Run the plugin-zip script with npm.
Enjoy the fatal error you get.

Screenshots, screen recording, code snippet

No response

Environment info

No response

Please confirm that you have searched existing issues in the repo.

Yes

Please confirm that you have tested with all plugins deactivated except Gutenberg.

Yes

[t-hamano]

Hi @maeseoki,

If you want to customize the files to be included in the zip file, the files field in package.json would be useful.

For example:

{
	"name": "test-block",
	"scripts": {
		"plugin-zip": "wp-scripts plugin-zip"
	},
	"files": [
		"vendor/your-package/**",
		"build/**",
		"includes/**",
		"languages/**",
		"test-block.php",
		"uninstall.php",
		"block.json",
		"changelog.*",
		"license.*",
		"readme.*"
	]
}

[maeseoki]

Hi.
Thank you for your response @t-hamano . The info was just right there.
I'm closing the issue then.

Edit:
If someone is wondering the best way to accomplish this, here's my solution:

As @t-hamano noted add /vendor/** to the files array and add a new script:
"bundle-plugin": "composer install --no-dev --optimize-autoloader && npm run build && npm run plugin-zip && composer install"

This way you just include Composer's runtime dependencies and a faster autoloader and after plugin-zip you get again your dev dependencies.

Composer will just remove dev dependencies and autoload classes with a classmap and then reinstall them so it's pretty fast.

[dashkevych]

is it possible to exclude package.json when customizing the files to be included in the zip file? It seems like it's automatically added to the .zip, even when using "!package.json" within files.

[t-hamano]

@dashkevych Thanks for the report.

I was able to reproduce the problem, so I summarized it in #61171.