Composer Packages WP Registry grade A. No security issues foundWP RegistryNo security issues foundOpen the reportA

Manage Composer packages from within WordPress.

REST API

A single REST API route allows registering a package version – and uploading its ZIP file – from outside WordPress, e.g. at the end of a release workflow.

POST /wp-json/composer-packages/v1/packages

The route is implemented as a WP_REST_Controller and behaves like any other WordPress REST API route, including its JSON schema and support for _fields.

Since the plugin serves its own JSON API at the site root, no other REST API route is reachable on the front end – only POST requests to this exact route are passed through to the REST API. The route is therefore neither listed in the REST API index nor discoverable via OPTIONS, and needs to be requested by its full URL. If the site doesn’t use pretty permalinks, use /?rest_route=/composer-packages/v1/packages instead.

Authentication

Authentication uses an application password of a user with the manage_options capability, sent as HTTP basic auth:

Authorization: Basic base64(username:application password)

WordPress only offers application passwords over HTTPS, so the site needs a valid TLS certificate.

Parameters

The uploaded file gets stored as <name>-v<version>.zip inside the base path of the product, which is where the download route expects it. The name of the uploaded file itself doesn’t matter.

file is optional: if the ZIP file reaches the server another way – e.g. via rsync – the route can be used to only register the package. Without a file, the request may also be sent as application/json.

Registering the same name and version again updates the existing package instead of creating a duplicate, so a workflow can safely be re-run.

Response

201 if the package has been created, 200 if an existing one has been updated:

{
    "authentication_required": true,
    "created": true,
    "file": "/srv/packages/my-plugin-v1.2.3.zip",
    "id": 42,
    "name": "my-plugin",
    "version": "1.2.3"
}

Add _fields to the request to limit the returned properties, e.g. ?_fields=id,file.

Errors are returned in the usual WordPress REST API format, with one of the following codes:

Note that uploads are limited by the upload_max_filesize and post_max_size settings of the server.

Usage in a GitHub Action

- name: Publish Composer package
  run: |
    curl --fail-with-body -sS -X POST \
      -u "${{ secrets.COMPOSER_PACKAGES_USER }}:${{ secrets.COMPOSER_PACKAGES_PASSWORD }}" \
      -F "name=${{ github.event.repository.name }}" \
      -F "version=${GITHUB_REF_NAME#v}" \
      -F "authentication_required=true" \
      -F "file=@${{ github.event.repository.name }}.zip" \
      "${{ secrets.COMPOSER_PACKAGES_URL }}/wp-json/composer-packages/v1/packages"