如何解决Composer命令在生产环境中的安全问题？使用php-tuf/composer-stager可以！

composer require php-tuf/composer-stager

class Updater
{
    public function __construct(
        private readonly BeginnerInterface $beginner,
        private readonly StagerInterface $stager,
        private readonly CommitterInterface $committer,
        private readonly CleanerInterface $cleaner,
        private readonly PathFactoryInterface $pathFactory,
        private readonly PathListFactoryInterface $pathListFactory,
    ) {
    }

    public function update(): void
    {
        $activeDir = $this->pathFactory->create('/var/www/public');
        $stagingDir = $this->pathFactory->create('/var/www/staging');
        $exclusions = $this->pathListFactory->create(
            'cache',
            'uploads',
        );

        // 复制代码库到临时目录
        $this->beginner->begin($activeDir, $stagingDir, $exclusions);

        // 在临时目录上运行 Composer 命令
        $this->stager->stage([
            'require',
            'example/package',
            '--update-with-all-dependencies',
        ], $activeDir, $stagingDir);

        // 将更改同步回活跃目录
        $this->committer->commit($stagingDir, $activeDir, $exclusions);

        // 清理临时目录
        $this->cleaner->clean($stagingDir);
    }
}