Tagging a core release with Composer 2.0.0-alpha3 fails spectacularly

Problem/Motivation

Drupal 10, the Automatic Updates Initiative, etc. will require Composer 2. Composer 2.0.0-alpha1 was released awhile ago and 2.0.0-alpha3 has just been released this week.

Yesterday I accidentally tried to tag the core bugfix releases using the Composer 2.0.0 alpha. It failed dramatically.

Steps to reproduce

These manually follow the automated steps used when creating a core release.

1. composer self-update 2.0.0-alpha3
2. Fetch the latest 9.0.x HEAD.
3. rm -rf vendor (to remove stale vendor created with Composer 1)
4. composer install --no-progress --no-suggest -n -q
5. Set the version constant in core/lib/Drupal.php
   

   diff --git a/core/lib/Drupal.php b/core/lib/Drupal.php
   index 5f9890ed33..098925e936 100644
   --- a/core/lib/Drupal.php
   +++ b/core/lib/Drupal.php
   @@ -80,7 +80,7 @@ class Drupal {
      /**
       * The current system version.
       */
   -  const VERSION = '9.0.4-dev';
   +  const VERSION = '9.0.4';
   
   

6. COMPOSER_ROOT_VERSION="9.0.4" composer update drupal/core*

Expected result: Composer updates the metapackages as appropriate for the 9.0.4 release.

Actual result: Composer outputs the following:

$ COMPOSER_ROOT_VERSION="9.0.4" composer update drupal/core*
> Drupal\Composer\Composer::ensureComposerVersion
Loading composer repositories with package information
Updating dependencies
Lock file operations: 0 installs, 3 updates, 0 removals
  - Downgrading drupal/core (9.0.x-dev => 9.0.4)
  - Downgrading drupal/core-project-message (9.0.x-dev => 9.0.4)
  - Downgrading drupal/core-vendor-hardening (9.0.x-dev => 9.0.4)
Writing lock file
Installing dependencies from lock file (including require-dev)
Package operations: 0 installs, 3 updates, 0 removals
  - Downgrading drupal/core-project-message (9.0.x-dev => 9.0.4): Symlinking from composer/Plugin/ProjectMessage
  - Downgrading drupal/core-vendor-hardening (9.0.x-dev => 9.0.4): Symlinking from composer/Plugin/VendorHardening
  - Downgrading drupal/core (9.0.x-dev => 9.0.4): Source already present
Generating autoload files
Could not scan for classes inside "core/lib/Drupal.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Component/DependencyInjection/Container.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Component/DependencyInjection/PhpArrayContainer.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Component/FileCache/FileCacheFactory.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Component/Utility/Timer.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Component/Utility/Unicode.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Core/Cache/Cache.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Core/Cache/CacheBackendInterface.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Core/Cache/CacheTagsChecksumInterface.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Core/Cache/CacheTagsChecksumTrait.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Core/Cache/CacheTagsInvalidatorInterface.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Core/Cache/DatabaseBackend.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Core/Cache/DatabaseCacheTagsChecksum.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Core/Database/Connection.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Core/Database/Database.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Core/Database/Driver/mysql/Connection.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Core/Database/Driver/pgsql/Connection.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Core/Database/Driver/sqlite/Connection.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Core/Database/Statement.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Core/Database/StatementInterface.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Core/DependencyInjection/Container.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Core/DrupalKernel.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Core/DrupalKernelInterface.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Core/Installer/InstallerRedirectTrait.php" which does not appear to be a file nor a folder
Could not scan for classes inside "core/lib/Drupal/Core/Site/Settings.php" which does not appear to be a file nor a folder
Class Drupal\Core\Composer\Composer is not autoloadable, can not call pre-autoload-dump script

                                                                               
  [RuntimeException]                                                           
  Could not scan for classes inside "core/lib/Drupal.php" which does not appe  
  ar to be a file nor a folder                                                 
                                                                               

update [--with WITH] [--prefer-source] [--prefer-dist] [--dry-run] [--dev] [--no-dev] [--lock] [--no-install] [--no-autoloader] [--no-scripts] [--no-suggest] [--no-progress] [--with-dependencies] [--with-all-dependencies] [-v|vv|vvv|--verbose] [-o|--optimize-autoloader] [-a|--classmap-authoritative] [--apcu-autoloader] [--ignore-platform-req IGNORE-PLATFORM-REQ] [--ignore-platform-reqs] [--prefer-stable] [--prefer-lowest] [-i|--interactive] [--root-reqs] [--] [<packages>]...

... and also deletes the entire contents of the core directory.

There is no workaround that I could find.

Proposed resolution

?

Remaining tasks

?

User interface changes

N/A

API changes

?

Data model changes

?

Release notes snippet

TBD