For example, where to put those 2 lines?

    composer config repo.packagist false
    composer config repo.composer '{"type": "composer", "url": "file://'"$PWD"'/.repo"}'

In the install or in the setup ?

In reply to @jtojnar:matrix.org
I only worry about project that need dev dependencies during build time

I've updated the composer plugin with new commands options:

            ->addOption('only-repo', 'r', InputOption::VALUE_NONE, 'Generate only the repository, without the manifest file "packages.json".')
            ->addOption('only-manifest', 'm', InputOption::VALUE_NONE, 'Generate only the manifest "packages.json", without the repository.')
            ->addOption('only-print-manifest', 'p', InputOption::VALUE_NONE, 'Print the manifest for a given arbitrary repository directory.');

The package installation procedure is now reduced to:

    # Remove "packages-dev" entries
    jq '."packages-dev" = []' composer.lock > newComposer.lock
    mv newComposer.lock composer.lock
    # Remove "require-dev" dependencies
    jq '."require-dev" = {}' composer.json > newComposer.json
    mv newComposer.json composer.json

    mkdir -p .repo

    # Create the manifest for the local repository
    COMPOSER_PROCESS_TIMEOUT=0 \
    COMPOSER_CACHE_DIR=/dev/null \
    COMPOSER_HOME="${composerVendorCache}/.composer" \
    composer --no-ansi build-local-repo -p $composerVendorCache > .repo/packages.json

    # Configure composer to use the local repository
    composer config repo.packagist false
    composer config repo.composer '{"type": "composer", "url": "file://'"$PWD"'/.repo/packages.json"}'

    # Merge the composer overrides to avoid randomly generated class names
    jq '. * input' "composer.json" "${composerOverrides}/composer.override.json" > newComposer.json
    mv newComposer.json composer.json

    echo "Finished composerInstallConfigureHook"