Specify the root package version to Composer so that it won't try to call unavailable command-line programs

.github/workflows/php-windows.yml

@@ -9,6 +9,7 @@ env:
   PHP_EXTENSIONS: bz2,ctype,curl,dom,filter,gd,iconv,mbstring,opcache,openssl,pdo,pdo_sqlite,phar,session,simplexml,sqlite3,tokenizer,xml,xmlwriter,yaml,zip,zlib
   PHP_LIBRARIES: libjpeg,libavif,freetype,libwebp
   PHP_VERSION: 8.3
+  WINBUILD_ACKNOWLEDGE_DEPRECATED: yes
 
 jobs:
   build:
@@ -18,7 +19,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           repository: crazywhalecc/static-php-cli
-          ref: 2.5.0
+          ref: 2.4.4
 
       - name: Generate cache key
         shell: bash

drupal-cms.js

@@ -18,16 +18,49 @@ const {
 } = require( 'yaml' );
 
 module.exports = async ( dir, { php, composer }) => {
+    // Send a customized copy of the current environment variables to Composer.
+    const env = Object.assign( {}, process.env );
+    // Set COMPOSER_ROOT_VERSION so that Composer won't try to guess the root
+    // package version, which would cause it to invoke Git and other
+    // command-line utilities that might not be installed and could therefore
+    // raise unexpected warnings on macOS.
+    // @see https://getcomposer.org/doc/03-cli.md#composer-root-version
+    env.COMPOSER_ROOT_VERSION = '1.0.0';
+    // For performance purposes, skip security audits for now.
+    // @see https://getcomposer.org/doc/03-cli.md#composer-no-audit
+    env.COMPOSER_NO_AUDIT = '1';
+
     // Use an awaitable version of execFile that won't block the main process,
     // which would produce a disconcerting beach ball on macOS.
-    await toPromise( execFile )(
+    const execFileAsPromise = toPromise( execFile );
+
+    // Create the project, but don't install dependencies yet.
+    await execFileAsPromise(
+        php,
+        [ composer, 'create-project', '--no-install', 'drupal/cms', dir ],
+        { env },
+    );
+
+    // Prevent core's scaffold plugin from trying to dynamically determine if
+    // the project is a Git repository, since that will make it try to run Git,
+    // which might not be installed.
+    await execFileAsPromise(
         php,
-        [ composer, 'create-project', 'drupal/cms', dir ],
+        [ composer, 'config', 'extra.drupal-scaffold.gitignore', 'false', '--json', `--working-dir=${dir}` ],
+        { env },
+    );
+
+    // Finally, install dependencies.
+    await execFileAsPromise(
+        php,
+        [ composer, 'install', `--working-dir=${dir}` ],
         {
+            env,
             // It should take less than 10 minutes to install Drupal CMS.
             timeout: 600000,
-        },
+        }
     );
+
     const webRoot = getWebRoot( dir );
 
     const siteDir = path.join( webRoot, 'sites', 'default' );