Declare Composer dependencies the package uses

.gitattributes

@@ -13,6 +13,7 @@
 .gitignore            export-ignore
 .phpactor.json        export-ignore
 CHANGELOG.md          export-ignore
+composer-dependency-analyser.php export-ignore
 docs/                 export-ignore
 phpstan-baseline.neon export-ignore
 phpstan-bootstrap.php export-ignore

.github/workflows/run-tests.yml

@@ -69,10 +69,20 @@ jobs:
 
       - name: Install dependencies
         run: |
+          # The matrix pins below rewrite composer.json for this job only.
+          # Put the published file back before validate and the dependency analyser.
+          cp composer.json "$RUNNER_TEMP/composer.json.orig"
           composer remove --dev --no-update larastan/larastan phpstan/phpstan-deprecation-rules phpstan/phpstan-phpunit phpstan/extension-installer
           composer require "laravel/framework:${{ matrix.laravel }}" "orchestra/testbench:${{ matrix.testbench }}" --no-interaction --no-update
           composer require --dev --no-update "nunomaduro/collision:^8.0"
           composer update --${{ matrix.stability }} --prefer-dist --no-interaction --with-all-dependencies
+          mv "$RUNNER_TEMP/composer.json.orig" composer.json
+
+      - name: Validate composer.json
+        run: composer validate --strict --no-check-lock
+
+      - name: Analyse composer dependencies
+        run: vendor/bin/composer-dependency-analyser
 
       - name: Execute tests
         run: vendor/bin/pest

README.md

@@ -389,8 +389,9 @@ Failed responses are mapped in `GithubConnector`:
 
 ## Requirements
 
-- PHP 8.2, 8.3, or 8.4
-- Laravel 11, 12, or 13 (`illuminate/contracts`)
+- PHP 8.2, 8.3, or 8.4, with the OpenSSL extension
+- Laravel 11, 12, or 13 (`illuminate/collections`, `illuminate/console`, `illuminate/http`, `illuminate/process`, and `illuminate/support`)
+- `nesbot/carbon` ^2.72.6 or ^3.8.4
 - `saloonphp/saloon` ^4.3
 - `firebase/php-jwt` ^7.0, used by GitHub App authentication
 - `spatie/laravel-package-tools` ^1.16 or ^2.0

composer-dependency-analyser.php

@@ -0,0 +1,20 @@
+<?php
+
+use ShipMonk\ComposerDependencyAnalyser\Config\Configuration;
+use ShipMonk\ComposerDependencyAnalyser\Config\ErrorType;
+
+// orchestra/testbench installs laravel/framework, which replaces illuminate/*.
+// Class files from those components are then attributed to laravel/framework,
+// and the illuminate packages look unused.
+return (new Configuration())
+    ->ignoreErrorsOnPackage('laravel/framework', [ErrorType::SHADOW_DEPENDENCY])
+    ->ignoreErrorsOnPackages(
+        [
+            'illuminate/collections',
+            'illuminate/console',
+            'illuminate/http',
+            'illuminate/process',
+            'illuminate/support',
+        ],
+        [ErrorType::UNUSED_DEPENDENCY],
+    );

composer.json

@@ -26,8 +26,14 @@
     ],
     "require": {
         "php": "^8.2",
+        "ext-openssl": "*",
         "firebase/php-jwt": "^7.0",
-        "illuminate/contracts": "^11.0||^12.0||^13.0",
+        "illuminate/collections": "^11.0||^12.0||^13.0",
+        "illuminate/console": "^11.0||^12.0||^13.0",
+        "illuminate/http": "^11.0||^12.0||^13.0",
+        "illuminate/process": "^11.0||^12.0||^13.0",
+        "illuminate/support": "^11.0||^12.0||^13.0",
+        "nesbot/carbon": "^2.72.6||^3.8.4",
         "saloonphp/saloon": "^4.3",
         "spatie/laravel-package-tools": "^1.16|^2.0"
     },
@@ -36,12 +42,14 @@
         "larastan/larastan": "^2.0||^3.0",
         "nunomaduro/collision": "^7.0||^8.0||^9.0",
         "orchestra/testbench": "^8.0||^9.0||^10.0||^11.0||^12.0",
+        "orchestra/testbench-core": "^8.0||^9.0||^10.0||^11.0||^12.0",
         "pestphp/pest": "^2.34||^3.0||^4.0",
         "pestphp/pest-plugin-arch": "^2.7||^3.0||^4.0",
         "pestphp/pest-plugin-laravel": "^2.3||^3.0||^4.0",
         "phpstan/extension-installer": "^1.3",
         "phpstan/phpstan-deprecation-rules": "^1.1||^2.0",
-        "phpstan/phpstan-phpunit": "^1.3||^2.0"
+        "phpstan/phpstan-phpunit": "^1.3||^2.0",
+        "shipmonk/composer-dependency-analyser": "^1.8"
     },
     "autoload": {
         "psr-4": {