Composer/Symfony: dependency issues

Context

I'm currently working on an OroPlatform project, which is based on Symfony 4.4 and deployed on Platform.sh.

I'm facing the following issue during the build phase of the deployment:

My app needs the package symfony/process 4.4.X
I don't know why, but on the Platform.sh server my app uses the symfony/process package installed for the composer binary installed globally, but this one is a 5.X version
So, I've got an error and I can't install my app because it uses the 5.X version instead of the 4.X
That's why I've found a workaround by using Composer 1.9.3 because it uses symfony/process 4.4.X, the same used by my app.

It was working well, but yesterday I have to bump the composer version to latest 1.X due to the Github OAuth token changes: https://nono.ma/github-oauth-token-for-github-com-contains-invalid-characters-on-composer-install

Issue

So, I'm still facing this issue with the 4.X version and the 5.X version.

I've tried to install the dependencies of my project this way : composer install -n -o -a but the bug still occurs.

I'm looking for a way to force my project to use the dependencies located in the vendor folder of my app and not the ones installed globally. Here is a screenshot of the issue on the Platform.sh server:

And here is a schema of the path of my app and composer on a Platform.sh server:

/app
|
|__/vendor/symfony-process
|
|__/.global/vendor/symfony-process

My composer.json:

{
    "name": "oro/platform-application",
    "description": "Oro Platform Empty Application",
    "homepage": "https://github.com/oroinc/platform-application.git",
    "license": "MIT",
    "autoload": {
        "psr-4": {
            "": "src/"
        },
        "classmap": [
            "src/AppKernel.php",
            "src/AppCache.php",
            "vendor/oro/platform/guzzle/Client.php"
        ],
        "exclude-from-classmap": [
            "/vendor/guzzle/guzzle/src/Guzzle/Http/Client.php",
            "**/Tests/"
        ]
    },
    "repositories": {
        "composer": {
            "type": "composer",
            "url": "https://packagist.orocrm.com"
        }
    },
    "require": {
        "php": "~7.3.13 || ~7.4.2",
        "oro/platform": "4.1.*",
        "oro/platform-serialised-fields": "4.1.*",
        "oro/oauth2-server": "4.1.*",
        "doctrine/doctrine-migrations-bundle": "^3.0"
    },
    "require-dev": {
        "behat/behat": "3.4.*",
        "behat/gherkin": "4.6.0",
        "behat/mink": "dev-master#6d637f7af4816c26ad8a943da2e3f7eef1231bea",
        "behat/mink-extension": "2.3.*",
        "behat/mink-selenium2-driver": "1.3.1",
        "behat/symfony2-extension": "2.1.*",
        "guzzlehttp/guzzle": "^6.0.0",
        "nelmio/alice": "3.6.*",
        "theofidry/alice-data-fixtures": "1.0.*",
        "phpunit/phpunit": "7.5.*",
        "johnkary/phpunit-speedtrap": "3.0.*",
        "mybuilder/phpunit-accelerator": "dev-master",
        "squizlabs/php_codesniffer": "3.5.*",
        "phpmd/phpmd": "2.6.*",
        "sebastian/phpcpd": "4.0.*",
        "phpunit/phpcov": "5.0.*",
        "symfony/phpunit-bridge": "4.4.*",
        "friendsofphp/php-cs-fixer": "2.16.*",
        "oro/twig-inspector": "1.0.*"
    },
    "config": {
        "component-dir": "public/bundles/components",
        "bin-dir": "bin",
        "fxp-asset": {
            "enabled": false
        }
    },
    "scripts": {
        "post-install-cmd": [
            "@build-parameters",
            "@set-permissions",
            "@install-assets",
            "@set-assets-version"
        ],
        "post-update-cmd": [
            "@build-parameters",
            "@set-permissions",
            "@update-assets",
            "@set-assets-version"
        ],
        "build-parameters": [
            "Incenteev\\ParameterHandler\\ScriptHandler::buildParameters"
        ],
        "set-permissions": [
            "Oro\\Bundle\\InstallerBundle\\Composer\\ScriptHandler::setPermissions"
        ],
        "install-assets": [
            "Oro\\Bundle\\InstallerBundle\\Composer\\ScriptHandler::installAssets"
        ],
        "update-assets": [
            "Oro\\Bundle\\InstallerBundle\\Composer\\ScriptHandler::updateAssets"
        ],
        "set-assets-version": [
            "Oro\\Bundle\\InstallerBundle\\Composer\\ScriptHandler::setAssetsVersion"
        ],
        "set-parameters": [
            "Oro\\Bundle\\InstallerBundle\\Composer\\ParametersHandler::set"
        ]
    },
    "minimum-stability": "dev",
    "prefer-stable": true,
    "extra": {
        "symfony": {
            "require": "4.4.*"
        },
        "symfony-web-dir": "public",
        "symfony-var-dir": "var",
        "symfony-bin-dir": "bin",
        "symfony-tests-dir": "tests",
        "incenteev-parameters": {
            "file": "config/parameters.yml"
        }
    }
}

Solution

Finally I've supposed that installing composer under the same folder as the web application don't seems to be a good practise. Moreover, it seems that Platform.sh don't use the composer binary.

So, I have change the build phase inside my .platform.app.yaml to avoid the way Platform.sh install Composer and use a custom way to do it:

# .platform.app.yaml
hooks:
  build: |
    set -e
    cd $PLATFORM_APP_DIR

    # install Composer
    chmod +x composer-install.sh
    ./composer-install.sh

# composer-install.sh

#!/bin/sh

EXPECTED_CHECKSUM="$(php -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')"
php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"
ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")"

if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]
then
    >&2 echo 'ERROR: Invalid installer checksum'
    rm composer-setup.php
    exit 1
fi

php composer-setup.php --1 --quiet
RESULT=$?
rm composer-setup.php
>&1 echo 'Composer successfully installed'
exit $RESULT