project create: bootstrap Composer temporarily when it is not installed globally

[shyim]

Problem

shopware-cli project create currently requires a global composer executable for local (non-Docker) projects:

• internal/system.CheckProjectDependencies() reports Composer as missing when composer is absent from PATH.
• runComposerInstall() calls exec.LookPath("composer") and immediately fails if it cannot be found.

Many shared hosting/webspace environments provide a usable PHP binary but do not permit a system-wide Composer installation or do not expose Composer on PATH. This makes project creation fail even though the CLI could safely run a temporary Composer PHAR with the selected PHP executable.

Docker project creation is unaffected because it already runs Composer inside the Docker image.

Goal

When creating a local, non-Docker project and no usable global Composer executable is available, bootstrap Composer into an isolated temporary directory for the duration of the command, run the install with the selected PHP binary, and remove all downloaded bootstrap artifacts before the command exits.

The fallback must be secure, explicit in its logging, and must not install Composer globally or write Composer files into the generated project directory.

Proposed behavior

Composer resolution

Introduce a reusable Composer resolver for the local creation path:

1. If composer is resolvable on PATH, retain the current behavior and use it.

2. If it is not resolvable, bootstrap a Composer PHAR in a new per-invocation directory created with os.MkdirTemp.

3. Invoke it as:

   <selected-php-binary> <temporary-dir>/composer.phar install --no-interaction
   

   The selected PHP binary must be the same one used by dependency validation and, once implemented, the PHP selection flow from project create: discover, select, and persist the local PHP binary #1303.

4. Delete the temporary directory with defer os.RemoveAll(...) on both success and failure.

5. Never modify PATH, write to a global Composer location, or persist the PHAR in the project directory.

The fallback is only for the absence of a global Composer binary. A Composer executable that is found but fails at runtime should surface its normal error; the CLI must not silently download another Composer and mask that failure.

Secure bootstrap

Use the official Composer download/installer mechanism and its documented integrity verification. The Composer download page publishes the installer verification workflow and supports an install directory/filename; do not embed a stale installer script or an unverified direct PHAR download. See Composer’s official download instructions.

Requirements:

• Download only over HTTPS from Composer-controlled official endpoints.
• Verify the installer/PHAR integrity with the official checksum/signature metadata before executing anything downloaded.
• Fail closed on checksum/signature mismatch, malformed metadata, unexpected HTTP status, a redirect to an untrusted host, or an incomplete download.
• Use an HTTP client with sensible connection/request timeouts and context cancellation.
• Set restrictive permissions for temporary files where supported.
• Remove the installer script as soon as it is no longer required; the entire temporary directory must be removed on exit.
• Log a concise, non-sensitive notice such as Composer was not found on PATH; using a temporary Composer download for this command.
• On bootstrap failure, return an actionable error that explains that Composer could neither be found nor downloaded, includes the underlying safe error, and suggests installing Composer or ensuring outbound HTTPS access.

Preflight and UX

• Update local project create preflight so a missing global Composer does not block the command before the fallback can run.
• PHP remains mandatory; if no compatible PHP executable is available, fail before attempting any Composer download.
• Do not attempt the fallback for --docker; Docker creation continues using the image-bundled Composer.
• This should work in interactive and --no-interaction modes. Do not add a confirmation prompt that would block automated deployments.
• Do not write a Composer path into .shopware-project.yml; the downloaded binary is command-scoped only.

Acceptance criteria

• A local project create succeeds when PHP is available, no composer is on PATH, and the official Composer endpoints are reachable.
• The CLI uses the existing global Composer executable when one is available and does not make a network request in that case.
• The temporary Composer PHAR is executed through the same selected PHP executable used for creation.
• No Composer artifacts remain in the project directory, user home directory, or global installation directories after success, cancellation, or failure.
• All temporary files/directories are cleaned up after every exit path.
• Integrity verification is mandatory; a bad checksum/signature or untrusted redirect is rejected and no downloaded executable is run.
• Missing Composer no longer appears as a blocking dependency for non-Docker project creation; missing/incompatible PHP remains blocking.
• Docker creation behavior is unchanged.
• A globally found Composer that exits with an error does not trigger the download fallback.
• Error messages distinguish “Composer not found”, “temporary Composer download failed”, and “Composer install failed”.

Testing

Add a testable downloader/resolver abstraction rather than coupling tests to the network. Cover at minimum:

• Composer found on PATH (no download).
• Composer missing (verified temporary PHAR path is returned).
• Checksum/signature mismatch, failed HTTP response, cancellation, timeout, and malformed metadata.
• Cleanup on successful install, failed install, and bootstrap failure.
• Invocation uses the supplied PHP binary and the PHAR path.
• Preflight permits missing Composer for local creation but still rejects missing/incompatible PHP.
• Docker bypasses the resolver/downloader entirely.

Use a local httptest server and fake PHP/Composer executables or an injected command runner; tests must not download Composer or depend on the developer machine.

Likely implementation areas

• internal/system/setup.go: allow the local create flow to proceed without a global Composer executable.
• A new focused internal/system Composer resolver/downloader package (or equivalent) with injected HTTP client, filesystem, and command execution seams.
• cmd/project/project_create_install.go: resolve Composer once, then construct the correct global-composer or php composer.phar command.
• Tests next to the resolver and project_create_install / dependency-preflight tests.

Out of scope

• Installing Composer globally.
• Persisting, caching, or self-updating Composer outside the command-scoped temporary directory.
• Replacing a Composer executable that was successfully resolved from PATH.
• Changing Docker Composer behavior.