Is there any tool to check a composer package for presence of actually used PHP extensions in "required", "required-dev" and "suggest" sections?

Question

I have made a composer package "foo" which uses ext-mysqli . On my dev box mysqli extension is present and so all my tests for this package succeed without any issue. But if this package would land on a box without mysqli extension installed then it would fail miserably. Composer addresses the issue by allowing "ext-*" in "require", "require-dev" and "suggest" sections. But a package developer should remember to actually put these dependencies in. And apparently there is nothing to stop a developer (or at least warn) before publishing a package without all used extensions listed as dependencies.

With multitude of extensions available today it is fairly easy to overlook these dependencies, especially when they are always satisfied on dev box used to develop a particular package and so no local test will reveal their absence.

Is there any tool which may check a composer package to see if it uses particular extensions and warn if extensions used not actually listed in composer.json?

Answer 1

ComposerRequireChecker should be exactly what you are looking for.

CLI tool that can be installed via composer

composer require maglnet/composer-require-checker

and used via

composer-require-checker check /path/to/your/project/composer.json

Answer 2

Thanks to answer by Jens A. Koch I decided to make such tool. It may be found on packagist.org as logics/extcheck package.

As expected it builds a dictionary out of installed extensions and then parses the source code referred in autoload and autoload-dev sections.

It is not implemented as a sniff due to a simple reason: CodeSniffer is mainly concerned with PHP/JS/CSS files and not with composer.json.

Basically to use it all you need to to is to add "logics/extcheck" package to "require-dev" section of composer.json , run "composer update" and then "vendor/bin/extcheck" . It will give you all extensions actually used by the code but not mentioned in composer.json. Call it with -v option and will also give you information about extensions uses.

Notably the original issue is wide spread and even well known/top packages actually have missing extension dependencies. If you think that you have added all required extensions to composer.json then try extcheck - I dare you! :)

Answer 3

Is there any tool which may check a composer package to see if it uses particular extensions and warn if extensions used not actually listed in composer.json?

No, such a tool doesn't exist (, yet).

You would need to parse the source-code to determine the extensions used. Probably by looking them up in a dictionary (for functions and constants provided by the extensions).

For instance, you could write it as a custom Sniff for PHPCodeSniffer.