Commit the pinned skeleton: Flarum v2.0.0-rc.5 (#2, step 2)

skeleton/README.md

@@ -0,0 +1,41 @@
+# The pinned Flarum skeleton
+
+`composer.json` + `composer.lock` describing exactly which Flarum this image
+installs. **The lock is the pin.** The constraints in `composer.json` are loose
+(`*` on the bundled extensions — that is Flarum's own skeleton style), but
+`composer install` from a committed lock installs the exact versions recorded in
+it and ignores the constraints entirely.
+
+These files are not this repository's own manifest. Nothing here is a PHP
+project; they describe the forum the image builds.
+
+## Why this exists
+
+The image used to resolve Flarum from Packagist when a container first started —
+`^2.0` at beta stability, plus six extensions at bare `*`. Seven floating
+constraints meant the same image tag could produce different forums a week
+apart, a first boot required working network access, and an image tag could not
+say which Flarum it contained. See issue #2.
+
+## Current pin
+
+Flarum `v2.0.0-rc.5`, 193 packages.
+
+Note there is **no stable Flarum 2.0 yet**, so `minimum-stability: beta` is
+currently required rather than a shortcut. When 2.0 goes stable, re-resolve and
+this can tighten.
+
+## Regenerating
+
+Do not resolve this by hand, and do not resolve it on a laptop. It needs PHP 8.3
+with the exact extension set the image ships — resolve somewhere missing `intl`
+or `exif` and Composer will pick versions production cannot run.
+
+Run **Actions → Resolve skeleton lock**, giving the Flarum version you want.
+Download the `skeleton-lock` artifact and commit the two files here. The
+workflow audits what it resolved and fails on any advisory, so a bump that would
+pin a known-vulnerable package cannot land quietly.
+
+That is the whole update path: moving Flarum is a reviewable diff in a pull
+request, instead of something that happens silently the next time a container
+boots.

skeleton/composer.json

@@ -0,0 +1,55 @@
+{
+    "name": "flarum/flarum",
+    "description": "Delightfully simple forum software.",
+    "type": "project",
+    "keywords": [
+        "forum",
+        "discussion"
+    ],
+    "homepage": "https://flarum.org/",
+    "license": "MIT",
+    "authors": [
+        {
+            "name": "Flarum",
+            "email": "info@flarum.org",
+            "homepage": "https://flarum.org/team"
+        }
+    ],
+    "support": {
+        "issues": "https://github.com/flarum/core/issues",
+        "source": "https://github.com/flarum/flarum",
+        "docs": "https://docs.flarum.org/"
+    },
+    "require": {
+        "flarum/approval": "*",
+        "flarum/audit": "^2.0@RC",
+        "flarum/bbcode": "*",
+        "flarum/core": "^2.0.0-rc.5",
+        "flarum/emoji": "*",
+        "flarum/extension-manager": "^2.0@RC",
+        "flarum/flags": "*",
+        "flarum/gdpr": "*",
+        "flarum/lang-english": "*",
+        "flarum/likes": "*",
+        "flarum/lock": "*",
+        "flarum/markdown": "*",
+        "flarum/mentions": "*",
+        "flarum/messages": "*",
+        "flarum/nicknames": "*",
+        "flarum/realtime": "^2.0@RC",
+        "flarum/statistics": "*",
+        "flarum/sticky": "*",
+        "flarum/subscriptions": "*",
+        "flarum/suspend": "*",
+        "flarum/tags": "*",
+        "fof/horizon": "^2.0@beta",
+        "fof/redis": "^2.0@beta",
+        "fof/upload": "^2.0@beta"
+    },
+    "config": {
+        "preferred-install": "dist",
+        "sort-packages": true
+    },
+    "minimum-stability": "beta",
+    "prefer-stable": true
+}