It'd be useful to know why/where composer.json requires came from
For MW core it's easier, but when they start coming from random extensions, or dependancies of dependancies.. It gets harder
We can't just add comments to json... So maybe some sort of simple structured companion file, and a composer test to check all requires etc in composer.json are in this "documentation" file, so we know where they came from
| Subject | Author | Repo | Branch | Lines +/- | |
|---|---|---|---|---|---|
| Add requires.sh to keep track of where requires come from | Gergő Tisza | mediawiki/vendor | master | +52 -0 |
The main complication is that we pin the entire dependency tree so most requires do not come from core or an extension directly but are a requirement for a requirement. And since those requirements change with every upgrade, and a library might be required by multiple things, it's quite hard to keep track even for just core why something is needed or whether it is still needed at all. This also makes it hard to verify that version requirements are met (T178137: MediaWiki-Vendor creates a scenario in which incompatible versions of dependencies can be present).
So yeah, we definitely need something. IMO a good first step is a bash script with a bunch of composer require ... lines (top level requirements only) with comments used to split it into sections by repo. That solves T178137 (you can just run the file and see if there's an error), and with some effort can be used to identify unneeded dependencies as well (delete composer.lock and composer.json, run the file, see if you ended up with a smaller set of requirements).
Change 503148 had a related patch set uploaded (by Gergő Tisza; owner: Gergő Tisza):
[mediawiki/vendor@master] [WIP] Add requires.sh to keep track of where requires come from
Change 503148 merged by jenkins-bot:
[mediawiki/vendor@master] Add requires.sh to keep track of where requires come from