Composer Require Checker Laravel Package

Getting Started

Minimal Steps

1. Install the tool (preferred method):

   wget https://github.com/maglnet/ComposerRequireChecker/releases/latest/download/composer-require-checker.phar
   chmod +x composer-require-checker.phar
   

   or globally via Composer:

   composer global require maglnet/composer-require-checker
   

2. Run a basic check in your project root:

   php composer-require-checker.phar check composer.json
   

   or if globally installed:

   composer-require-checker check composer.json
   

3. Review output for soft dependencies (e.g., guzzlehttp/guzzle used but not required).

First Use Case

Preventing "soft dependency" breakage during major updates:

• After cloning a repo, run:

  composer install
  composer-require-checker check
  

• Fix any reported issues by adding missing require entries to composer.json.

Implementation Patterns

Daily Workflow

1. Pre-Merge Checks

   • Add to CI/CD pipeline (e.g., GitHub Actions):

     - name: Check soft dependencies
       run: php composer-require-checker.phar check composer.json
     

   • Fail builds if soft dependencies are detected.

2. Post-Update Verification

   • After composer update, run:

     composer-require-checker check --diff
     

   • Compare results with previous scan to catch new soft dependencies.

3. Custom Config for Teams

   • Create composer-require-checker.json to:
     • Whitelist internal packages (e.g., "whitelist": ["company/*"]).
     • Ignore specific files (e.g., "ignore-files": ["tests/*"]).
     • Scan additional files (e.g., "scan-files": ["bin/console"]).

Integration Tips

• Laravel-Specific:

  • Add to composer.json scripts:

    "scripts": {
      "post-update-cmd": [
        "@php composer-require-checker check"
      ]
    }
    

  • Use --diff to compare against a baseline (store results in checker-baseline.json).

• Monorepos:

  • Run per-package:

    find packages -name composer.json -exec php composer-require-checker.phar check {} \;
    

• Custom Autoloading:

  • For packages using autoload-dev, add to config:

    "scan-files": ["tests/**/*.php"]
    

Gotchas and Tips

Pitfalls

1. False Positives with Xdebug

   • Disable Xdebug for scans:

     XDEBUG_MODE=off php composer-require-checker.phar check composer.json
     

   • Or configure in php.ini for the tool’s PHP binary.

2. Custom Installer Plugins

   • Workaround for non-vendor/ files:

     composer install --no-plugins
     composer-require-checker check
     composer install  # Restore plugins
     

3. PHP Extensions

   • False alarms for json_encode or file_get_contents:
     • Whitelist in config:

       "extensions": {
         "json": true,
         "fileinfo": true
       }
       

4. Performance

   • Exclude large directories (e.g., node_modules) via:

     "ignore-files": ["**/node_modules/**"]
     

Debugging

• Verbose Output:

  composer-require-checker check --verbose
  

• Dry Run:

  composer-require-checker check --dry-run
  

  (Shows what would be checked without analyzing files.)

• Baseline Mode:

  composer-require-checker check --baseline=checker-baseline.json
  

  (Store results to compare future runs.)

Extension Points

1. Custom Rules

   • Extend via config (e.g., block specific packages):

     "blocked": ["symfony/debug-bundle"]
     

2. CI Integration

   • Example GitHub Actions:

     - name: Enforce hard dependencies
       run: |
         if ! php composer-require-checker.phar check --format=json | jq -e '.violations | length == 0'; then
           echo "Soft dependencies found!"
           exit 1
         fi
     

3. IDE Support

   • Use --format=json to parse results in tools like PHPStorm for quick navigation to violations.

Laravel-Specific Quirks

• Service Providers:

  • Soft dependencies often appear in providers (e.g., use Illuminate\Support\Facades\Cache).
  • Solution: Require illuminate/support explicitly or whitelist illuminate/*.

• Facades:

  • Facades like Mail::to() may pull in illuminate/mail indirectly.
  • Mitigate by requiring the facade’s base package:

    "require": {
      "illuminate/support": "^10.0"
    }