request for optional strict rule requiring packages using phpstan/phpstan to also use phpstan/phpstan-strict-rules

[SignpostMarv]

Not sure if rules that analyse composer.lock are within the scope of this project, but I'd find it useful (from a housekeeping stand point) to be able to configure phpstan to check that any package that has phpstan/phpstan listed in it's dependencies, then report those that don't also require phpstan/phpstan-strict-rules

i.e.

• package A/A includes A/B, A/C, A/D, B/Foo C/Bar
• packages A/* use phpstan/phpstan in require-dev
• package B/Foo uses phpstan/phpstan, package C/Bar does not use phpstan
• package A/A, A/B, A/D use phpstan/phpstan-strict-rules
• running phpstan on A/A drops an error saying A/C & B/Foo do not use phpstan/phpstan-strict-rules

[ondrejmirtes]

This is a really weird request 😊 My opinion is that phpstan/phpstan is a dev dependency and users of a package should not care about its dev dependencies. I don't really see a point in this.

When you're using a package, you should only care about its public interface and not about the internal implementation, let alone how it's developed.

Can you elaborate on why you want this?

[SignpostMarv]

for making sure I don't forget to run phpstan/phpstan-strict-rules on all of the things :P

[SignpostMarv]

or to phrase it another way; I might remember to composer require --dev phpstan/phpstan on my packages, but if I then go and composer require said package on another package, it'd be nice to have a little reminder to say "hey, you're using phpstan/phpstan-strict-rules on the current pacakage, but one of the dependencies that uses phpstan/phpstan doesn't use phpstan/phpstan-strict-rules, maybe you want to go patch it in ?"

[ondrejmirtes]

That's a really weird solution to a problem 😊 What about having some composer.json template for all new projects or something like that? How do you make sure that you don't forget to add something else?

You might want to write your own Composer plugin for that, similar to https://github.com/Ocramius/PackageVersions.

[SignpostMarv]

this is more for older packages that're still in use (i.e. really->far->down->the->dependency->chain) - I was doing a static analysis sprint at work today in between other tasks, stumbled across packages that were using a php-cs-fixer 1.x config class & possibly pre-0.8 phpstan:dev-master in require-dev.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.