Composer is installed on the production server.


As part of my automatic deployment shell script, I run the following SSH command to install the PHP dependencies, using Composer, on the production server:

ssh host 'cd /path/to/site-root && composer install --optimize-autoloader --no-dev --no-progress'

Adjust host to the actual SSH host and the path to the site on the server.

Notice this command also includes --no-dev to make sure we only install the dependencies that are required for the production environment (specified in require and not in require-dev).

This installation approach allows us to version control (include in the project’s Git repository) only the composer.json and composer.lock files while the actual dependencies are not included there (/vendor/ directory is listed in .gitignore).