I have a dependency hosted in a private git repository, and am using satis for package management. I've tagged a commit to the master branch of the repo as "1.0.0", and in the composer.json file, where I wish to use that package, I've specified
"require": {
"package/name": "~1.0"
},
"repositories": [
{
"type": "composer",
"url": "http://myownsatisrepo"
},
"config": {
"preferred-install": "dist"
}
and am running the command composer install --prefer-dist
So the fact that I've specified a stable package version should ensure that composer won't just clone the repo (including a .git folder, which I don't want), but instead downloads a package. The extra config flag and parameter to the install command should do the same. Still, composer only clones the package though.
Composer can only download a distribution ZIP if it knows how to get it. Otherwise (or if getting it fails), it will clone the repository.
When you are using certain well known Git repository hosters like Github and Bitbucket, Composer knows about their API structure and where to download ZIP files. If you are using something else, it doesn't.
As a last fallback, the metadata in your Satis could theoretically include download URLs for the ZIP files. Satis allows you to configure creating these files, but then you'd have the hosting capacity for all the ZIP files in addition to the Composer meta data. If you don't let Satis create ZIPs, and are using a repository that does not offer download capabilities known to Composer, you will always trigger a cloning of the repository no matter what.
Note that once Composer got the source code one way or the other, it will stick with it until you delete the whole vendor folder. Especially if you cloned the repository, it is faster and uses less traffic if Composer simply updates to the latest commit and then checks out the needed commit.