Add Composer Dependency Analyser

.github/workflows/composer-require-checker.yml → .github/workflows/composer-dependency-analyser.yml

@@ -1,28 +1,28 @@
+name: composer dependency analyser
+
 on:
   pull_request:
     paths: &paths
+      - 'config/**'
       - 'src/**'
-      - '.github/workflows/composer-require-checker.yml'
+      - 'tests/**'
+      - '.github/workflows/composer-dependency-analyser.yml'
       - 'composer.json'
-      - 'composer-require-checker.json'
-
+      - 'composer-dependency-analyser.php'
   push:
     branches: ['master']
     paths: *paths
 
-name: Composer require checker
+permissions:
+  contents: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
-permissions:
-  contents: read
 jobs:
-  composer-require-checker:
-    uses: yiisoft/actions/.github/workflows/composer-require-checker.yml@master
+  composer-dependency-analyser:
+    uses: yiisoft/actions/.github/workflows/composer-dependency-analyser.yml@master
     with:
       php: >-
         ['8.1', '8.2', '8.3', '8.4', '8.5']
-      required-packages: >-
-        ['db']

composer-dependency-analyser.php

@@ -0,0 +1,41 @@
+<?php
+
+declare(strict_types=1);
+
+use ShipMonk\ComposerDependencyAnalyser\Config\Configuration;
+use ShipMonk\ComposerDependencyAnalyser\Config\ErrorType;
+
+$config = (new Configuration())
+    ->disableComposerAutoloadPathScan()
+    ->setFileExtensions(['php'])
+    ->addPathToScan(__DIR__ . '/config', isDev: false)
+    ->addPathToScan(__DIR__ . '/src', isDev: false)
+    ->addPathToScan(__DIR__ . '/tests', isDev: true)
+    // These are optional (suggested) dependencies used unconditionally in opt-in traits;
+    // consumers who don't `use` the trait don't need the package. See the "suggest" section
+    // in composer.json.
+    ->ignoreErrorsOnPackages(
+        ['yiisoft/arrays', 'yiisoft/event-dispatcher', 'yiisoft/factory'],
+        [ErrorType::DEV_DEPENDENCY_IN_PROD],
+    )
+    // psr/event-dispatcher is the PSR interface backing the optional yiisoft/event-dispatcher
+    // integration above; it's only needed when a consumer wires that integration up.
+    ->ignoreErrorsOnPackages(
+        ['psr/event-dispatcher'],
+        [ErrorType::SHADOW_DEPENDENCY],
+    )
+    // config/bootstrap.php is only invoked by a DI container, so a PSR-11 implementation
+    // is always present at runtime even though this package doesn't require one itself.
+    ->ignoreErrorsOnPackageAndPath(
+        'psr/container',
+        __DIR__ . '/config/bootstrap.php',
+        [ErrorType::SHADOW_DEPENDENCY],
+    );
+
+if (PHP_VERSION_ID < 80200) {
+    // Native PHP attribute available since PHP 8.2; not autoloadable on lower PHP versions,
+    // which are still within the supported range (see "php" in composer.json).
+    $config->ignoreUnknownClasses(['AllowDynamicProperties']);
+}
+
+return $config;

composer.json

@@ -34,9 +34,10 @@
         "ext-pdo": "*",
         "bamarni/composer-bin-plugin": "^1.8.3",
         "friendsofphp/php-cs-fixer": "^3.89.1",
-        "maglnet/composer-require-checker": "^4.7.1",
         "phpunit/phpunit": "^10.5.58",
+        "psr/simple-cache": "^2.0|^3.0",
         "rector/rector": "^2.2.3",
+        "shipmonk/composer-dependency-analyser": "^1.8",
         "spatie/phpunit-watcher": "^1.24",
         "yiisoft/arrays": "^3.2",
         "yiisoft/db-mssql": "^2.0",
@@ -93,6 +94,7 @@
         }
     },
     "scripts": {
+        "dependency-analyser": "composer-dependency-analyser",
         "test": "phpunit --testdox --no-interaction",
         "test-watch": "phpunit-watcher watch"
     }

docs/internals.md

@@ -107,12 +107,11 @@ use either newest or any specific version of PHP:
 ./vendor/bin/rector
 ```
 
-## Composer require checker
+## Dependencies
 
-This package uses [composer-require-checker](https://github.com/maglnet/ComposerRequireChecker) to check if all dependencies are correctly defined in `composer.json`.
-
-To run the checker, execute the following command:
+Use [Composer Dependency Analyser](https://github.com/shipmonk-rnd/composer-dependency-analyser) to detect unknown,
+shadow, and unused [Composer](https://getcomposer.org) dependencies:
 
 ```shell
-./vendor/bin/composer-require-checker
+./vendor/bin/composer-dependency-analyser
 ```