Ensure composer dist archive contains only usefull files

[cedric-anne]

With proposed changes, Github configuration, demo, documentation and test files will no more be included in composer dist archives.

Package weight will decrease from 175kB to 62kB. This is not a big change, but your package is downloaded almost 4k per day, so on the long term, it can save lots of bandwidth.

Anyway, problem is not only related to bandwidth and disk usage. On a project I work on, we had in the past a severe security flaw (unauthenticated RCE) that was located in a demo file of a library we used. I do not think there is such a flaw in your demo/test files (I did not tried to find one), but now you know why I propose such a PR.

[NicolasCARPi]

Example of such issues in the past: https://nvd.nist.gov/vuln/detail/CVE-2017-9841

It's wrong to expose your vendor dir anyway, but it doesn't hurt to distribute only the necessary files!

[cedric-anne]

It's wrong to expose your vendor dir anyway

I agree, but I am working on an opensource application that, sometimes, people are putting on unprotected webserver. We do our best to prevent this, but we cannot control how webserver is configured, and I guess people may use such unsecure configurations for every application they use.

[willpower232]

great idea, I didn't know this was a thing

[willpower232]

@cedric-anne just so you know, this didn't seem to change the files that ended up in my vendor folder, if you'd like to take another look at your discretion, I'd be happy to resolve this.

[NicolasCARPi]

I believe the issue is the missing .gitattributes file. See: https://gitlab.com/gitlab-org/gitlab/-/issues/352063#note_944741629

[cedric-anne]

We could indeed list ignored files in .gitattributes instead of in composer.json:archive.exclude, but what I proposed should work.
If you run composer archive command, you will see that files are correctly excluded.

I open an issue on composer/packagist repository, to try to know if something should be changed here: composer/packagist#1364

[cedric-anne]

My bad, see #103.