Build phar with box and bump dependency versions

[jakzal]

re #371 #364

Advantages of dropping legacy PHP versions:

• less maintenance burden

Advantages of box:

• standardised way to build phar files
• it's faster
• possibility to scope phar classes (not part of this PR)

Disadvantages of box:

• it diverges from the ant build system set up for this project. It only makes sense if everything else is migrated over and the ant setup is removed (it seems to be unmaintained).

[jakzal]

There's loads of tests with no assertions, but one thing at a time.

[codecov-io]

Codecov Report

Merging #372 into master will increase coverage by 1.35%.
The diff coverage is n/a.

@@             Coverage Diff              @@
##             master     #372      +/-   ##
============================================
+ Coverage     87.88%   89.24%   +1.35%     
  Complexity     3105     3105              
============================================
  Files           202      202              
  Lines          8939     8728     -211     
============================================
- Hits           7856     7789      -67     
+ Misses         1083      939     -144

Impacted Files	Coverage Δ	Complexity Δ
src/main/php/PDepend/Util/ImageConvert.php	78.78% <0%> (-3.04%)	11% <0%> (ø)
...ource/Language/PHP/PHPTokenizerHelperVersion52.php	92.59% <0%> (-2.15%)	9% <0%> (ø)
src/main/php/PDepend/TextUI/Runner.php	76.66% <0%> (-2.03%)	25% <0%> (ø)
src/main/php/PDepend/Source/AST/ASTClass.php	11.11% <0%> (-1.94%)	20% <0%> (ø)
src/main/php/PDepend/TextUI/ResultPrinter.php	60.52% <0%> (-1.02%)	19% <0%> (ø)
src/main/php/PDepend/TextUI/Command.php	85.87% <0%> (-0.69%)	74% <0%> (ø)
src/main/php/PDepend/Report/Summary/Xml.php	97.43% <0%> (-0.24%)	32% <0%> (ø)
...ain/php/PDepend/Source/AST/AbstractASTCallable.php	97.14% <0%> (-0.23%)	41% <0%> (ø)
...main/php/PDepend/Source/AST/ASTCompilationUnit.php	98.18% <0%> (-0.16%)	27% <0%> (ø)
src/main/php/PDepend/Report/Overview/Pyramid.php	97.82% <0%> (-0.14%)	29% <0%> (ø)
... and 39 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update bb7a53b...b89e6b9. Read the comment docs.

[emirb]

cc @manuelpichler @ravage84

[theofidry]

I think it's more standard to put the phone before, but that's just CS anyway...

[theofidry]

for those targets I would add touch $@ to avoid the target to get outdated. You sometimes have cases where the target timestamp is not updated properly otherwise making the whole Makefile usage more flimsy.

This comment applies to the other Makefile targets

[theofidry]

note that this could be improve (but I would suggest to do that in another PR)

[theofidry]

I think the platform needs to be a specific version, e.g. 7.1.3. -o -a are overkill since -a implies -o and Box will take care of dumping the autoloader in authoritative mode anyway (so doing it here results in the autoloader being dumped twice)

[kylekatarnls]

I changed settings to use environment variable instead of hard coded tokens, then resolved the conflict on .travis.yml

I think we should even pick PHP 7.2 as minimum level of the next major PDepend, like for PHPMD, and this could start as soon as version 2 with PHP 5.3 would support properly PHP 7.0 to 7.3. Seems more logical to me to first fully support a PHP level before jumping to it. That's why I switched the base branch to 3.x but it's not engraved in stone, we can debate.

[kylekatarnls]

PHPMD 3 will be ^7.2, I think we should align. And I think we should also target PHP 7.4 for the next major release of PDepend.

[kylekatarnls]

If we PHP ^7.2, PHPUnit can be ^8.0