I can currently not test it, as the composer repository of connect is broken, but I hope it's still useful.
composer.json of my own project https://github.com/Cotya/DashboardProject/blob/6ce3f307c53a3fb54c94d8a7bd70b306036da928/composer.json
I changed recently to
"magento/product-community-edition": "^2.0" to actually be able to update with a simple
composer update --with-dependencies magento/product-community-edition command.
I always explicitly name what should be updated, to not mix it up with the other packages I require besides magento, but therefore I need the
A very important part of this workflow is to commit the
composer.lock file after each (successfully tested) update. As you see the diff of the lock file is too big for GitHub, that's a result of all the dependency updates and the reason, why you should not mix up a magento update with an update of something else.
As you can see, I have defined the files for
NonComposerComponentRegistration myself, you can have multiple of them.
Downside of my approach is, that when changes in the project
composer.json happen, you need to apply them manually.
As you asked about the updating of the
NonComposerComponentRegistration file, there are still a "few" files, which get copied out of vendor into the target directory, that's why I named it explicitly
build to not mix up own with generated/copied stuff.
Hope that helps, even if this is quite a unique setup of M2.