DX: lock SCA tools for PR builds

[keradus]

We recently had an issue that master started to fail because on an update of PHPStan, starting detecting new issues.
To avoid confusion for contributors, we suggested on maintainers meeting to lock the dev-tools and updated them occasionally (eg once per Q). Same time, for master build, that is observed mostly by maintainers, we can still look for bleeding-edge version of SCA tools

[keradus]

cc @localheinz @julienfalque @kubawerlos @SpacePossum

[coveralls]

Coverage remained the same at 93.027% when pulling e9a48fa on keradus:dev-tools-lock into efeab76 on FriendsOfPHP:master.

[kubawerlos]

I'd vote for removing ^ from dev-tools/composer.json instead of having dev-tools/composer.lock committed, 4k lines of unnecessary noise.

[kubawerlos]

Update your Composer :)

[kubawerlos]

@keradus ping ☝🏼

[keradus]

i don't see any value in analysing the lock file on this moment and it doesn't bother anyone but you

[kubawerlos]

it doesn't bother anyone but you

I thought you were better than this... In fact I was hoping you would update your Composer and discover by yourself this new option of Composer 2.2 and update composer.json accordingly.

[keradus]

you quoted part of my line. let me rephrase (the whole line) - I'm not aware of benefits for doing so, if any - you didn't bother to mention any initially, and everyone else already approved the PR.

You want to be picky? tell ppl what to update.
You want to share some interesting idea? give the reasoning from start - it works way better ;)

[kubawerlos]

tell ppl what to update.

I did

Update your Composer :)

Well, it will stop working in July, so I guess no need to update it right now :P

[keradus]

I'd vote for removing ^ from dev-tools/composer.json instead of having dev-tools/composer.lock committed

it won't lock the deep-deps (dependencies of dependency)

[localheinz]

👍

[kubawerlos]

it won't lock the deep-deps (dependencies of dependency)

Obviously, but why do we need to lock them? If some dependency needs to be locked that mean it should be explicitly added to composer.json.

[keradus]

I wouldn't share that claim, myself.
You don't know which dependency needs to be locked until you explicitly experience issue because of it (like first-time contributor creates a PR and it failed on SCA for nothing related to given PR). Locking all SCA deps with lock-file prevents that, locking only 1st level dependencies (not using lock file) will only minimise the risk

[SpacePossum]

Thank you @keradus.