Add Composer Dependency Analyser (#60)

Author: vjik

.github/workflows/composer-dependency-analyser.yml

@@ -0,0 +1,71 @@
+name: composer dependency analyser
+
+on:
+  pull_request:
+    paths: &paths
+      - 'src/**'
+      - 'tests/**'
+      - '.github/workflows/composer-dependency-analyser.yml'
+      - 'composer.json'
+      - 'composer-dependency-analyser.php'
+  push:
+    branches: ['master']
+    paths: *paths
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  composer-dependency-analyser:
+    name: PHP ${{ matrix.php }}
+    runs-on: windows-latest
+    strategy:
+      matrix:
+        php:
+          - 7.4
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Install PHP
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        with:
+          php-version: ${{ matrix.php }}
+          tools: composer:v2
+          coverage: none
+
+      - name: Choco install 7zip
+        uses: crazy-max/ghaction-chocolatey@dfdcf5bba9c0a16358a21c13a06ec5c89024b3ac # v4.1.0
+        with:
+          args: install 7zip
+
+      - uses: suisei-cn/actions-download-file@9f75b8c2dad5ccced7509c44a3b881c5613abde2 # v1.6.1
+        id: wincache
+        name: Download WinCache
+        with:
+          url: "https://downloads.sourceforge.net/project/wincache/development/wincache-2.0.0.8-dev-7.4-nts-vc15-x64.exe"
+          target: C:\tools\php\ext
+
+      - name: Install WinCache
+        run: |
+          cd C:\tools\php\ext
+          7z e -y wincache-2.0.0.8-dev-7.4-nts-vc15-x64.exe
+
+      - name: Update php.ini
+        run: |
+          cd C:\tools\php
+          echo extension=php_wincache.dll >> php.ini
+          echo wincache.enablecli=1 >> php.ini
+
+      - name: Install Composer dependencies
+        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
+
+      - name: Check dependencies
+        run: vendor/bin/composer-dependency-analyser

composer-dependency-analyser.php

@@ -0,0 +1,12 @@
+<?php
+
+declare(strict_types=1);
+
+use ShipMonk\ComposerDependencyAnalyser\Config\Configuration;
+use ShipMonk\ComposerDependencyAnalyser\Config\ErrorType;
+
+return (new Configuration())
+    ->disableComposerAutoloadPathScan()
+    ->setFileExtensions(['php'])
+    ->addPathToScan(__DIR__ . '/src', false)
+    ->addPathToScan(__DIR__ . '/tests', true);

composer.json

@@ -36,9 +36,10 @@
     },
     "require-dev": {
         "friendsofphp/php-cs-fixer": "^3.92.5",
-        "rector/rector": "^2.3.0",
         "phpunit/phpunit": "^9.5",
+        "rector/rector": "^2.3.0",
         "roave/infection-static-analysis-plugin": "^1.16",
+        "shipmonk/composer-dependency-analyser": "^1.8.4",
         "spatie/phpunit-watcher": "^1.23",
         "vimeo/psalm": "^4.18"
     },
@@ -63,6 +64,7 @@
         }
     },
     "scripts": {
+        "dependency-analyser": "composer-dependency-analyser",
         "test": "phpunit --testdox --no-interaction",
         "test-watch": "phpunit-watcher watch"
     }

docs/internals.md

@@ -24,3 +24,12 @@ The code is statically analyzed with [Psalm](https://psalm.dev/). To run static
 ```shell
 ./vendor/bin/psalm
 ```
+
+## Dependencies
+
+Use [Composer Dependency Analyser](https://github.com/shipmonk-rnd/composer-dependency-analyser) to detect unknown,
+shadow, and unused [Composer](https://getcomposer.org) dependencies:
+
+```shell
+./vendor/bin/composer-dependency-analyser
+```