phpBB uses GitHub for collaborative development in the open source community. It uses phpbb.com, for obvious reasons, for it's distribution.
Extensions can do whatever they want. If you want to be endorsed by phpBB, then they must go through our validation process and they will, like phpBB, be distributed through phpbb.com.
You can develop and collaborate on extensions however you see fit... Use Git, SVN, or whatever. Obviously we at phpBB like to see Git/GitHub because it's the de-facto standard for open source projects these days.
We suggest using GitHub's Releases for extensions (in development) because:
- GitHub offers an excellent release interface you can use, which is nice for you and end-users.
- You will save yourself the trouble of dealing with newbies that don't understand how to install an extension due to the packaging requirements. Just attach a nice pre-packaged zip to your release, so the end user simply unzips and copies it to ext/.
- To promote your extension while it is under development on phpBB.com we require you to have a download link (if it's in alpha/beta). GitHub allows this, meaning you don't need your own hosting service. It also looks a lot more professional than linking to a zip on some shady file download service.
- It's free.
- The repository itself is source code. While this may be enough for some simpler projects, source code usually contains extra stuff that doesn't belong in the release that you ship. Not to mention a repository usually contains bleeding-edge developing code. What you really want is for people to be downloading stable release versions that are built and packaged for distribution.
Back to the OP, this is why it makes no sense to have a vendor directory in your repository. Because if phpBB, for example, had to commit all the hundreds/thousands of files that change whenever it updates Twig, or Symphony, etc... and copy those files to the repo, it would be a nightmare. 3rd party software like those composer dependencies should always be ignored in git projects. Collaborators on the project should know they must run composer to obtain those dependencies if they want to work on the source code of the project (and run it), which is exactly why the composer.phar and composer.lock files are in the repo (which are a lot simpler to maintain than a vendor full of libraries/frameworks).
Any project using composer to add/manage dependencies will need a build regiment for packaging its releases (either by a script or manual process). phpBB has a build script which runs composer, deletes all the stuff we don't want (like composer.phar/lock) and that results in what we distribute on phpbb.com as phpBB 3.1.x.
If you have an extension and you've added dependencies to it via composer, you should follow this process. The skeleton extension will soon have a build script added to it, but you can look at most of phpBB's official extension repos and see they have build scripts too (they don't have any dependencies, but the scripts do the job of cleaning out development/repo only files and creating a zip of the extension in the proper packaging structure).