Add composer.json linting to every matrix about laminas-ci-matrix-action

[weierophinney]

I'd argue we should do validation directly in this action, and then have the action generate one or more jobs that performs the require-checker and unused checks (normalize is really only interesting if we do a diff and/or autocommit the changes).

(Validation in this action would be required, as it would guarantee that the composer install/update operations in the CI action do not fail.)

[Slamdunk]

I'd argue we should do validation directly in this action
Validation in this action would be required, as it would guarantee that the composer install/update operations in the CI action do not fail.

That'd be great, but how would you do that, considering that composer validate command needs PHP runtime, but this actions runs on node?

normalize is really only interesting if we do a diff and/or autocommit the changes

That is right, but I don't think it's worth the effort of building such tool.
After the initial normalization, for which I can open a PR on all laminas packages with a trivial script to run on my pc, composer normalize rarely fails because who edits the composer.json easily adapt the new changes to the present style.

[weierophinney]

That'd be great, but how would you do that, considering that composer validate command needs PHP runtime, but this actions runs on node?

Composer publishes its schema, and we can use node-based tooling to validate the composer.json file against it.

[boesing]

I've added a schema valiation in #33

composer validate --strict

After this, I think it could be worth adding composer validate --strict --no-check-all to keep things simple.

composer-normalize

composer-normalize will probably fail in some projects, so I'd say we should have this as opt-in.

composer-require-checker

composer-require-checker could be problematic as we are using use statements in many components but do not directly require that dependency.
This is no problem unless these use statements are used for instanceOf.
When used as implementations (like I accidentally did in mezzio/mezzio#78), it should throw errors. As fair as I know, composer-require-checker cannot differentiate between these things and thus will fail in mezzio/mezzio with almost all optional implementations.
Having configurations for these projects will become a hilarious amount of maintenance imho. But if there are suggestions on how to keep maintenance at a minimum level, just let us know.

composer-unused

There are plenty of cases where composer-unused still has false-positives (like when classmap or files is used rather than PSR-4/PSR-0).

---

So overall, I think I would be fine with having some of these tools available as "informative" checks which wont fail.
The only thing I really would love to see is composer validate tho (even tho, I'd say lets stick with --no-checks-all --strict).

[weierophinney]

Accomplished with #33.