Bundle auto-registration uses a literal text match, missing bundles that extend an intermediate base

[tacman]

For a type: symfony-bundle package without a recipe, Flex auto-registers it in config/bundles.php only if the concrete class file literally contains Symfony\Component\HttpKernel\Bundle\Bundle or ...\AbstractBundle — a raw str_contains() on the file bytes, no autoloading or reflection:

https://github.com/symfony/flex/blob/v2.11.0/src/SymfonyBundle.php#L109-L113

So a bundle extending an intermediate base (e.g. class MyBundle extends AbstractMyVendorBundle, where the vendor base extends AbstractBundle) has neither literal in its own file and is silently skipped — composer req installs it but never updates config/bundles.php. The check also doesn't match the Symfony 8 base Symfony\Component\DependencyInjection\Kernel\AbstractBundle.

I'd argue type: symfony-bundle should be enough on its own. Options for a PR:

1. Reflection — at install time the class is autoloadable, so check is_subclass_of($class, BundleInterface::class). Robust against intermediate bases and namespace moves.
2. Remove the heuristic — trust the symfony-bundle type.
3. Fail loudly — if the package's class doesn't resolve to a BundleInterface, throw rather than silently skipping.

Happy to make a PR.

[stof]

1. Reflection — at install time the class is autoloadable, so check is_subclass_of($class, BundleInterface::class). Robust against intermediate bases and namespace moves.

This is not true. By the time Flex runs, composer has not registered an autoloader for all packages being installed.
And we don't want to register one ourselves, as this would cause issue with the security model of composer, as those classes would suddenly be loaded inside the composer process before you get a chance to review whether the package is fine or no (this is why composer plugins require an opt-in to allow them to run).

[tacman]

Thanks, @stof . What about dropping this? If the type is symfony-bundle in composer.json, isn't that enough? If it's not, it won't auto-register, but that's already the case.

[Neirda24]

Hi @tacman . As discussed in slack, I'll add it here as well.

How can symfony "auto-detect" YOUR class ? I think reading an extra attribute from composer.json would eliminate the need to discover anything. WDYT ?

[tacman]

I see -- because it looks for this specific class to add to bundle.php. Then it looks for the keyword 'dev' to decide if it should be in dev/test only, but not prod.

Yes, and extra attribute in composer.json would work. Or a heuristic like "this class name ends with Bundle". And/or it's location, it's the only file in src and it's named like a bundle and it extends something like a bundle or abstract bundle?

This is my current solution, to put a comment in my bundle class with the exact matching string.

// Symfony\Component\HttpKernel\Bundle\Bundle <-- Flex auto-registration marker (see Survos\Kit\AbstractSurvosBundle)
final class SurvosTuiExtrasBundle extends AbstractSurvosBundle
{
}