How to make composer NOT create a .git directory for a package

If a package is seen as a git submodule, you haven't excluded the vendor folder from being committed to your own repository. It is recommended to add the vendor folder to .gitignore, and not commit these files, only commit composer.lock (and composer.json of course).

Apart from that, running composer install --prefer-dist should do the job. Note that Composer seems to not change the download method used first if you change your mind later. If Composer detects a cloned repo, it is faster to just update that instead of downloading a ZIP and unpacking it. If you want to change that, delete the whole vendor folder and run composer update --prefer-dist.

Using --prefer-dist is the only native solution, but there will be situations where there is simply no packaged version available, and in those cases Composer will still fall back to git clones.

The only workaround I know of is to run a cleanup script after composer install that removes Git directories. Maybe a command like this:

find . -type d | grep .git | xargs rm -rf

Be careful to run this in your vendor directory, not your root directory.

composer update --prefer-dist works fine, but it might be simpler to just change the default download method for composer packages (composer.json):

{
"config": {
    "preferred-install": {
        "*": "dist"
    }
  }
}

https://getcomposer.org/doc/06-config.md#preferred-install