🚀 Quick Start

This page walks you through your first Composer Skills program with the fewest possible steps. Two examples cover both SDKs: the Packagist API (pure Go, no PHP needed) and the Composer CLI wrapper (requires local PHP + Composer).

🧭 Roadmap

📦 Step 0: Install

go get github.com/scagogogo/composer-skills

System requirements

• Go 1.23+ (go.mod declares go 1.23.0)
• Packagist API example: no external dependencies, pure Go.
• Composer CLI example: PHP 7.4+ and Composer 2.0+ (the SDK auto-installs Composer if missing). See Installation.

🌐 Example 1: Packagist API query (no PHP needed)

This example does not depend on local PHP/Composer. It calls Packagist over HTTP to search packages, fetch details, and view statistics and security advisories.

package main

import (
    "fmt"
    "time"

    "github.com/scagogogo/composer-skills/pkg/client"
)

func main() {
    // Create a client with a 30-second timeout
    c := client.NewComposerClient(30 * time.Second)

    // 1. Search packages
    results, err := c.SearchPackages("logging", 10, 1)
    if err != nil {
        fmt.Printf("search failed: %v\n", err)
        return
    }
    fmt.Printf("🔍 Found %d packages related to logging\n", results.Total)

    // 2. Get package details
    pkg, err := c.GetPackage("monolog/monolog")
    if err != nil {
        fmt.Printf("get details failed: %v\n", err)
        return
    }
    fmt.Printf("📦 %s: %s\n", pkg.Package.Name, pkg.Package.Description)

    // 3. Security advisories
    advisories, _ := c.GetSecurityAdvisories()
    fmt.Printf("🔒 %d security advisories currently\n", len(advisories.Advisories))

    // 4. Statistics
    stats, _ := c.GetStatistics()
    fmt.Printf("📈 Total packages on Packagist: %d\n", stats.Packages)
}

Expected output:

🔍 Found 1234 packages related to logging
📦 monolog/monolog: Sends your logs to files, sockets, inboxes, databases and various web services
🔒 521 security advisories currently
📈 Total packages on Packagist: 395821

(Numbers vary with live Packagist data.)

🛠️ Example 2: Composer CLI wrapper (needs PHP + Composer)

This example installs dependencies and audits vulnerabilities in a local PHP project. If Composer is not installed, DefaultOptions() enables AutoInstall and pulls it automatically.

package main

import (
    "fmt"
    "log"

    "github.com/scagogogo/composer-skills/pkg/composer"
)

func main() {
    // AutoInstall is on by default: missing Composer is auto-installed
    comp, err := composer.New(composer.DefaultOptions())
    if err != nil {
        log.Fatalf("init failed: %v", err)
    }
    comp.SetWorkingDir("/path/to/php/project")

    // Install dependencies
    if err := comp.Install(false, true); err != nil {
        log.Fatalf("install failed: %v", err)
    }

    // Add a package
    _ = comp.RequirePackage("monolog/monolog", "^3.0", false)

    // Security audit (structured result)
    result, err := comp.AuditWithJSON()
    if err != nil {
        log.Fatalf("audit failed: %v", err)
    }
    fmt.Printf("🔒 Vulnerabilities found: %d\n", result.Found)
    for _, v := range result.Advisories {
        fmt.Printf("  ⚠ %s: %s (%s)\n", v.Package, v.Title, v.Severity)
    }
}

Working directory

Replace the SetWorkingDir path with a local PHP project directory that contains a composer.json, otherwise install/require will fail because it cannot find composer.json.

Expected output:

🔒 Vulnerabilities found: 0

If the project has known-vulnerable dependencies, each vulnerability's package name, title, and severity is listed.

⚡ Even simpler: QuickSetup

If you want to do it in one step — detect + auto-install + get an instance — use QuickSetup:

comp, err := composer.QuickSetup("/path/to/php/project", true)
if err != nil {
    log.Fatal(err)
}
// comp is ready, call any method directly

🧭 Next steps

• 📦 Installation — dependency requirements, environment variables, verifying the install.
• 🏗️ Dual SDK architecture — when to use the Packagist API vs. the Composer CLI.
• 🔧 Auto-install mechanism — the full detect → PHP → install → verify → ready flow.
• 🧪 Typed return values — AuditResult, OutdatedResult and other structured results.
• 🔄 CI/CD pipelines — put the audit into GitHub Actions.