search

kalessil / production-dependencies-guard

MIT License
87 stars 2 forks source link

Is there any way to declare own protected dependecies list? #1

Closed Insolita closed 5 years ago

Insolita commented 5 years ago

Currently, it check and prevent to install dependencies declared in Repository, so if someone create library for dev purpose,than he, or community should add PR with new package in this repo. But what about internal project packages for dev, that often has created for big complex projects

Insolita commented 5 years ago

Also, there may be some exceptional cases. For example i 'm familiar with project that use fzaninotto/faker in production, because the generation random data by rules - it is part of business logic

kalessil commented 5 years ago

We could use type property of composer-manifest, e.g. code sniffer coding standards has it set to "type": "phpcodesniffer-standard". If there are commonly agreed type for development-only packages, then it should be quite straightforward to implement.

kalessil commented 5 years ago

Hi @fzaninotto, is fzaninotto/faker intended for use in production environments?

kalessil commented 5 years ago

Since faker documentation says composer require fzaninotto/faker, let's assume it can be used in production, I'll drop it from the list.

kalessil commented 5 years ago

@Insolita: #6 should cover the custom dev-packages detection topic.