Add composer-dependency-analyser to CI (fix shadow & misplaced dependencies)

[janedbal]

• Documentation: https://github.com/shipmonk-rnd/composer-dependency-analyser
• Unused dependencies are ignored for now, it is more tricky (will try in next PR)
• Misplaced dependency was only nette/finder and jetbrains/phpstorm-stubs (unused in src, used only in tests)
• See shadow dependencies report before the fix:

[janedbal]

@ondrejmirtes Any comments on this one? I believe it found real issues and thus make sense to keep it in CI to guard that. Also, the package is stable now.

[ondrejmirtes]

I agree, we could remove composer-require-checker if this one does a better job. But my priority now is to finish and release 1.11 (and I'm travelling to PHP UK this werk) so I'll most likely start processing the backlog of emails (currently 130) after that.

[janedbal]

@ondrejmirtes Ok, I removed composer-require-checker, updated the tool and fixed one more issue. It is also rebased so it could be merged now if you feel so.

[ondrejmirtes]

What command did you please use to update composer.lock here? I need it so I can replay the changes on 1.11.x

[janedbal]

composer update --lock, see docs

[ondrejmirtes]

Thanks!

[ondrejmirtes]

Just realized this advice is wrong.

Example:

1. 1.10.x updates phpstan/phpdoc-parser from 1.25.0 to 1.26.0.
2. I merge 1.10.x into 1.11.x and get conflict in composer.lock
3. I run git checkout --ours composer.lock to get it look like on top of 1.11.x.

Now I need to rerun the commands that make the lock file being changed in 1.10.x. Running composer update --lock is not sufficient, it's going to keep phpdoc-parser on version 1.25.0 in composer.lock. But I want it to be 1.26.0.

The correct solution is to run composer update phpdoc-parser.

[janedbal]

My working flow:

• I merge all non-conflicting stuff of composer.lock in PHPStorm merge tool.
• The only conflict is the hash, I pick any.
  • If not, some package got update on both sides.
• I fix that hash by composer update --lock

[ondrejmirtes]

I see!

[ondrejmirtes]

Thank you very much!