A Composer script to manage PHAR tool dependencies directly from composer.json, ensuring consistent toolchains across development environments.
Tooly is a Composer script that manages PHAR (PHP Archive) tool dependencies through a project's composer.json file. It automates the download and verification of PHAR files, ensuring consistent tool versions across development teams and CI/CD systems without storing binaries in version control.
PHP developers and teams working on projects that rely on external CLI tools distributed as PHAR files, particularly those needing reproducible builds and automated toolchain setup.
Developers choose Tooly because it integrates PHAR management directly into Composer's workflow, offering declarative versioning, optional GPG signature verification for security, and support for development-only tools to keep production environments clean.
Simple composer script to manage phar files using project composer.json.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Integrates PHAR tool declarations directly into composer.json, ensuring all developers and CI systems use identical versions without storing binaries in version control, as shown in the sample usage.
Supports GPG signature verification via the sign-url parameter, allowing authenticity checks for downloaded PHARs when the tm/gpg-verifier package is installed.
Enables marking tools as development-only with the only-dev parameter, keeping production installations clean by excluding them when composer is run with --no-dev.
The force-replace parameter allows non-interactive updates, making it suitable for automated build processes where user input isn't available, as highlighted in the README.
GPG verification requires installing an additional package (tm/gpg-verifier) and having GPG binaries in PATH, which can fail if public keys aren't in the keychain, adding setup overhead.
Restricted to managing PHP Archive files, so it cannot handle other binary types or executables, limiting its utility for projects with diverse toolchains.
Relies on remote URLs for downloads; if a URL changes or becomes inaccessible, it can break tool installation unless fallback URLs are configured, requiring maintenance.