Options for running composer validate as part of the installation

[ramsey]

In #265, @TimWolla suggested running composer validate as part of the installation. I think this is a great idea, but it comes with a decision to make, especially since this could be viewed as a breaking change. What do you think?

In a nutshell, with this feature, composer validate would run before installation to validate composer.json, which, among other things, ensures the composer.lock file (if present) is up-to-date with the latest changes to composer.json. If it fails, this action would immediately stop, reporting a failure state.

If we decide it should be an opt-in or opt-out feature, I'll add a validate property to the action like this:

steps:
  - uses: "ramsey/composer-install@v3"
    with:
      validate: true

[TimWolla]

Note that composer validate takes additional arguments that folks might be interested in (e.g. --strict or --no-check-publish for applications rather than libraries). So some degree of configuration would be necessary.

[ramsey]

Thanks for pointing that out. Yes, even if this is always on, we'd have to add some configuration option(s).

[Jean85]

I voted "opt-in, then opt-out" for SemVer's sake, since this could potentially break a lot of builds, like many others it seems.

This is a great functionality though! I imagine a lot of composer.json being fixed because of that! 😁

[Seldaek]

I'm for opt-in but I think what you might be able to add by default is a run of composer validate that does not fail the build if it fails, it'd just output the warnings and carry on. So it'd always run but the flag would be fail: bool (default false). If you find a way to surface the errors to everyone without breaking their build that'd have the most impact i think

[greg0ire]

I think that can be done with something like this: phpstan/phpstan#274

[greg0ire]

Voted " Opt-in for 3.x, switching to always on in 4.x, with no way to opt-out ". If it's the wrong choice, you can always add an opt-out feature in 4.1.