Ignore development-only packages in security check

[fredden]

Proposed Changes

Only perform security check on actual dependencies / ignore development-only dependencies for this check.

Related Issues

#228 (comment)

[jrfnl]

Makes sense to me. Thanks @fredden!

[jrfnl]

🤔 Hmm... based on the build on your fork, this doesn't solve it for PHP 5.4...? Composer still creates the lock file, even if the packages aren't being installed and the lock file is what's used by the Security check...

[fredden]

🤔 Hmm... based on the build on your fork, this doesn't solve it for PHP 5.4...? Composer still creates the lock file, even if the packages aren't being installed and the lock file is what's used by the Security check...

I've updated the check command to use the actually-installed packages instead.

[jrfnl]

Interesting. Looks like checking the installed.json file is an undocumented option.

Also noticed that the Local security checker package is now deprecated in favour of the composer audit command.

We should probably update this workflow to use that once support for PHP < 7.2 has been dropped (issue #221).

[fredden]

It turns out that this checker tool also has a --no-dev flag which could have been used here. If you would prefer that method, let me know and I will update this pull request accordingly.