fix: COMPOSER_INSTALL_OPTIONS from options.json silently ignored (#1265)

fixtures/composer_install_options/.bp-config/options.json

@@ -0,0 +1,3 @@
+{
+    "COMPOSER_INSTALL_OPTIONS": ["--dev"]
+}

fixtures/composer_install_options/composer.json

@@ -0,0 +1,9 @@
+{
+    "name": "cloudfoundry/composer_install_options_test",
+    "require": {
+        "php": ">=8.1"
+    },
+    "require-dev": {
+        "psr/log": "^3.0"
+    }
+}

fixtures/composer_install_options/htdocs/index.php

@@ -0,0 +1,11 @@
+<?php
+require '../lib/vendor/autoload.php';
+
+// psr/log is a require-dev dependency.
+// If COMPOSER_INSTALL_OPTIONS: ["--dev"] is honoured, this class exists.
+if (interface_exists('Psr\Log\LoggerInterface')) {
+    echo "dev dependencies installed";
+} else {
+    http_response_code(500);
+    echo "dev dependencies missing";
+}

src/php/integration/composer_test.go

@@ -117,6 +117,28 @@ func testComposer(platform switchblade.Platform, fixtures string) func(*testing.
 			})
 		})
 
+		// Regression test for https://github.com/cloudfoundry/php-buildpack/issues/1265
+		// COMPOSER_INSTALL_OPTIONS in options.json was silently ignored in v5 because
+		// supply.go never wrote the parsed value into the extension Context.Data map.
+		// As a result, composer always ran with the hardcoded default ["--no-interaction",
+		// "--no-dev"], making it impossible to install dev dependencies via options.json.
+		context("composer app with COMPOSER_INSTALL_OPTIONS set to --dev in options.json", func() {
+			it("installs dev dependencies (issue #1265)", func() {
+				deployment, logs, err := platform.Deploy.
+					WithEnv(map[string]string{
+						"COMPOSER_GITHUB_OAUTH_TOKEN": os.Getenv("COMPOSER_GITHUB_OAUTH_TOKEN"),
+					}).
+					Execute(name, filepath.Join(fixtures, "composer_install_options"))
+				Expect(err).NotTo(HaveOccurred(), logs.String)
+
+				// Staging log must NOT contain --no-dev, confirming the user option overrides the default
+				Expect(logs.String()).NotTo(ContainSubstring("--no-dev"))
+
+				// The running app confirms psr/log (a require-dev package) was installed
+				Eventually(deployment).Should(Serve(ContainSubstring("dev dependencies installed")))
+			})
+		})
+
 		if !settings.Cached {
 			context("deployed with invalid COMPOSER_GITHUB_OAUTH_TOKEN", func() {
 				it("logs warning", func() {

src/php/supply/supply.go

@@ -201,6 +201,7 @@ func (s *Supplier) createExtensionContext() (*extensions.Context, error) {
 	// Set additional options
 	ctx.Set("ADMIN_EMAIL", s.Options.AdminEmail)
 	ctx.Set("COMPOSER_VENDOR_DIR", s.Options.ComposerVendorDir)
+	ctx.Set("COMPOSER_INSTALL_OPTIONS", s.Options.ComposerInstallOptions)
 
 	// Set dynamic PHP version variables
 	for key, version := range s.Options.PHPVersions {