We want to use composer.json to specify development dependencies (T90943), however those extensions don't necessarily want to be published as composer packages.

I submitted https://github.com/composer/composer/pull/3804 which has been merged upstream to add a --no-check-publish which still ensures the file has valid syntax, but doesn't require it to be valid to be published as a composer package ('name' and 'description').

We should create a 'php-composer-validate-package' job which checks the composer.json file is valid to be published as a composer package for repos that do want that. All other extensions would use 'php-composer-validate', which uses the --no-check-publish option.

We'll have to also update our composer to something that has my patch (or backport it?).