Bundle composer vendor dependencies with released tarballs to support reproducible build system packaging

[amessina]

🚀 Feature

Bundling composer vendor dependencies with released tarballs supports build system (like Koji) packaging that doesn't enable network connections. This is in support of reproducible builds.

[marclaporte]

Related: #597

[marclaporte]

@kroky what do you think?

[kroky]

Yes, +1 for bundling the vendor packages with the release tarballs.

[Shadow243]

It seams like the GITHUB_TOKEN provided by GitHub Actions has limited permissions by default. I'l review it and create a new one with right access permission.

[Shadow243]

@marclaporte @kroky @amessina Can we close this since the PR is already merged ?

[marclaporte]

I'l review it and create a new one with white access permission

Is it done?

[Shadow243]

I'l review it and create a new one with white access permission

Is it done?

since the last release we have cypht.tar.gz which is added to the release and which contains the vendor folder already with the dependencies

#1142

I just checked, the token has expired since like a week. I will have to renew that