Check Composer dependencies in the test workflow

.gitattributes

@@ -13,6 +13,7 @@
 .gitignore            export-ignore
 .phpactor.json        export-ignore
 CHANGELOG.md          export-ignore
+composer-dependency-analyser.php export-ignore
 docs/                 export-ignore
 phpstan-baseline.neon export-ignore
 phpstan-bootstrap.php export-ignore

.github/workflows/run-tests.yml

@@ -69,10 +69,20 @@ jobs:
 
       - name: Install dependencies
         run: |
+          # The matrix pins below rewrite composer.json for this job only.
+          # Put the published file back before validate and the dependency analyser.
+          cp composer.json "$RUNNER_TEMP/composer.json.orig"
           composer remove --dev --no-update larastan/larastan phpstan/phpstan-deprecation-rules phpstan/phpstan-phpunit phpstan/extension-installer
           composer require "laravel/framework:${{ matrix.laravel }}" "orchestra/testbench:${{ matrix.testbench }}" --no-interaction --no-update
           composer require --dev --no-update "nunomaduro/collision:^8.0"
           composer update --${{ matrix.stability }} --prefer-dist --no-interaction --with-all-dependencies
+          mv "$RUNNER_TEMP/composer.json.orig" composer.json
+
+      - name: Validate composer.json
+        run: composer validate --strict --no-check-lock
+
+      - name: Analyse composer dependencies
+        run: vendor/bin/composer-dependency-analyser
 
       - name: Execute tests
         run: vendor/bin/pest

composer-dependency-analyser.php

@@ -0,0 +1,20 @@
+<?php
+
+use ShipMonk\ComposerDependencyAnalyser\Config\Configuration;
+use ShipMonk\ComposerDependencyAnalyser\Config\ErrorType;
+
+// orchestra/testbench installs laravel/framework, which replaces illuminate/*.
+// Class files from those components are then attributed to laravel/framework,
+// and the illuminate packages look unused.
+return (new Configuration())
+    ->ignoreErrorsOnPackage('laravel/framework', [ErrorType::SHADOW_DEPENDENCY])
+    ->ignoreErrorsOnPackages(
+        [
+            'illuminate/collections',
+            'illuminate/console',
+            'illuminate/http',
+            'illuminate/process',
+            'illuminate/support',
+        ],
+        [ErrorType::UNUSED_DEPENDENCY],
+    );

composer.json

@@ -48,7 +48,8 @@
         "pestphp/pest-plugin-laravel": "^2.3||^3.0||^4.0",
         "phpstan/extension-installer": "^1.3",
         "phpstan/phpstan-deprecation-rules": "^1.1||^2.0",
-        "phpstan/phpstan-phpunit": "^1.3||^2.0"
+        "phpstan/phpstan-phpunit": "^1.3||^2.0",
+        "shipmonk/composer-dependency-analyser": "^1.8"
     },
     "autoload": {
         "psr-4": {