Add Composer Dependency Analyser (#324)

Author: vjik

.github/workflows/composer-dependency-analyser.yml

@@ -0,0 +1,29 @@
+name: composer dependency analyser
+
+on:
+  pull_request:
+    paths: &paths
+      - 'config/**'
+      - 'src/**'
+      - 'stubs/**'
+      - 'tests/**'
+      - '.github/workflows/composer-dependency-analyser.yml'
+      - 'composer.json'
+      - 'composer-dependency-analyser.php'
+  push:
+    branches: ['master']
+    paths: *paths
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  composer-dependency-analyser:
+    uses: yiisoft/actions/.github/workflows/composer-dependency-analyser.yml@master
+    with:
+      php: >-
+        ['8.1', '8.2', '8.3', '8.4', '8.5']

.github/workflows/composer-require-checker.yml

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+use ShipMonk\ComposerDependencyAnalyser\Config\Configuration;
+use ShipMonk\ComposerDependencyAnalyser\Config\ErrorType;
+
+return (new Configuration())
+    ->disableComposerAutoloadPathScan()
+    ->setFileExtensions(['php'])
+    ->addPathToScan(__DIR__ . '/config', isDev: false)
+    ->addPathToScan(__DIR__ . '/src', isDev: false)
+    ->addPathToScan(__DIR__ . '/stubs', isDev: false)
+    ->addPathToScan(__DIR__ . '/tests', isDev: true)
+    // ext-pcntl / ext-posix are optional (see "suggest" in composer.json): only needed when
+    // using `Yiisoft\Queue\Cli\SignalLoop` and its tests, not for the package to function.
+    ->ignoreErrorsOnExtensions(['ext-pcntl', 'ext-posix'], [ErrorType::SHADOW_DEPENDENCY])
+    // yiisoft/yii-debug integration in src/Debug is an optional debug panel collector, only
+    // loaded when the consumer wires up yiisoft/yii-debug themselves.
+    ->ignoreErrorsOnPackages(['yiisoft/yii-debug'], [ErrorType::DEV_DEPENDENCY_IN_PROD]);

composer-dependency-analyser.php

@@ -48,11 +48,11 @@
     },
     "require-dev": {
         "friendsofphp/php-cs-fixer": "^3.95.11",
-        "maglnet/composer-require-checker": "^4.7.1",
         "phpbench/phpbench": "^1.4.3",
         "phpunit/phpunit": "^10.5.63",
         "rector/rector": "^2.5.2",
         "roave/infection-static-analysis-plugin": "^1.35",
+        "shipmonk/composer-dependency-analyser": "^1.8",
         "vimeo/psalm": "^5.26.1 || ^6.16.1",
         "yiisoft/code-style": "^1.0",
         "yiisoft/test-support": "^3.2.0",
@@ -91,5 +91,8 @@
             "composer/package-versions-deprecated": true,
             "yiisoft/config": false
         }
+    },
+    "scripts": {
+        "dependency-analyser": "composer-dependency-analyser"
     }
 }

composer-require-checker.json

@@ -36,9 +36,9 @@ use either newest or any specific version of PHP:
 
 ## Dependencies
 
-This package uses [composer-require-checker](https://github.com/maglnet/ComposerRequireChecker) to check if
-all dependencies are correctly defined in `composer.json`. To run the checker, execute the following command:
+Use [Composer Dependency Analyser](https://github.com/shipmonk-rnd/composer-dependency-analyser) to detect unknown,
+shadow, and unused [Composer](https://getcomposer.org) dependencies:
 
 ```shell
-./vendor/bin/composer-require-checker
+./vendor/bin/composer-dependency-analyser
 ```