Composer: move PHPCS dependency to require

[jrfnl]

PHPCS is a direct dependency for this utility to be run, so should be in require.

The problem with not having it there is that other external /project rulesets may have different PHPCS requirements and Composer will not be able to take the requirements for this project into consideration when doing the version negotiations unless the dependency is explicitly set in require.

Relying on PHPCS being installed with the DealerDirect plugin is not stable as they may change their minimum required PHPCS version without notice.

As the minimum version in the composer.json file and the one in the README were not in line (though very close), I've also updated the minimum required version as mentioned in the README to be in line.

Question: as the Composer install instructions already suggest using the DealerDirect plugin, why not make that a no-dev requirement as well ?

[sirbrillig]

That's a good point. Thanks for taking care of it! I just want to get the CI tests to run (not sure why they don't run for contributor PRs...) before merging.

Question: as the Composer install instructions already suggest using the DealerDirect plugin, why not make that a no-dev requirement as well ?

That's an interesting idea. My instinct is not to do so since there are a lot of other patterns people use for installing sniffs and I don't know that this is the best one.

[jrfnl]

My instinct is not to do so since there are a lot of other patterns people use for installing sniffs and I don't know that this is the best one.

I've been hesitant about this myself before, but over the past two years I've found:

1. Of the Composer plugins out there, this one has floated to the top. Others are no longer maintained/working.
2. Most other "solutions" used for Composer via post-install hooks etc (symlinking the standard into PHPCS itself, moving the standard directory manually/via a script into PHPCS itself etc), are actually hacks from before the ability to set the installed_paths command and/or hacks because people are not aware of installed_paths.

FYI: As of the next majors, I intend to make the Dealerdirect plugin a require dependency for both WPCS as well as PHPCompatibility.

[sirbrillig]

That's good to know! In that case maybe it's a good idea to do here too. (FWIW on WordPress.com we don't have a composer project for our repo so we use installed_paths.)

[jrfnl]

FWIW on WordPress.com we don't have a composer project for our repo so we use installed_paths.

For non-Composer installs that's the way to go and that's basically what the Composer PHPCS plugin automates for you when Composer is used.

Both WPCS as well as PHPCompatibility will get an underlying external standard dependency as of the next version (PHPCSUtils). So, that's the reason to start adding the plugin to the require section as of then, as that makes setting the installed_paths manually a little more involved.
Still perfectly possible, but you'll need to set two (or three) paths instead of just the one.