composer-json-validator

by charlie-morrison

Install this Skill

curl -fsSL -o composer-json-validator.zip https://skill.seembox.com/api/v1/skills/composer-json-validator/download && unzip composer-json-validator.zip

Download composer-json-validator.zip

SKILL.md About

---
name: composer-json-validator
description: Validate and lint PHP Composer composer.json files for structure, dependencies, autoload, and best practices. Use when asked to lint, validate, check, or audit composer.json files, verify PHP project configuration, or ensure Composer quality. Triggers on "lint composer", "validate composer.json", "check php deps", "composer best practices".
---

# Composer JSON Validator

Validate and lint PHP Composer `composer.json` files for structure, dependencies, autoload configuration, and best practices.

## Commands

### lint — Run all lint checks

```bash
python3 scripts/composer_json_validator.py lint composer.json
python3 scripts/composer_json_validator.py lint composer.json --strict
python3 scripts/composer_json_validator.py lint composer.json --format json
python3 scripts/composer_json_validator.py lint composer.json --format markdown
```

### dependencies — Inspect require/require-dev

```bash
python3 scripts/composer_json_validator.py dependencies composer.json
python3 scripts/composer_json_validator.py dependencies composer.json --format json
```

### scripts — Inspect scripts section

```bash
python3 scripts/composer_json_validator.py scripts composer.json
python3 scripts/composer_json_validator.py scripts composer.json --format markdown
```

### validate — Full validation (structure + lint + summary)

```bash
python3 scripts/composer_json_validator.py validate composer.json
python3 scripts/composer_json_validator.py validate composer.json --strict --format json
```

## Flags

| Flag | Description |
|------|-------------|
| `--strict` | Exit code 1 on warnings (CI-friendly) |
| `--format text` | Human-readable output (default) |
| `--format json` | Machine-readable JSON |
| `--format markdown` | Markdown report |

## Lint Rules (22 checks)

### Structure (5)
1. Valid JSON syntax
2. Required fields: `name`, `description`, `type`
3. Valid package name format (`vendor/package`)
4. Valid `type` value (`library`, `project`, `metapackage`, `composer-plugin`)
5. `license` field present and valid SPDX identifier

### Dependencies (6)
6. No duplicate packages across `require` and `require-dev`
7. Version constraints use valid operators (`^`, `~`, `>=`, etc.)
8. No dev-only packages in `require` (phpunit, mockery, etc.)
9. No wildcard `*` versions
10. PHP version constraint present in `require`
11. `ext-*` dependencies are explicit (not `*`)

### Autoload (4)
12. PSR-4 autoload defined
13. Namespace ends with `\\` (PSR-4 convention)
14. No duplicate namespaces across autoload entries
15. `autoload-dev` separate from `autoload`

### Best Practices (7)
16. `scripts` section present
17. No `post-install-cmd`/`post-update-cmd` executing arbitrary URLs
18. `config.sort-packages` enabled
19. `minimum-stability` explicit when not `stable`
20. `prefer-stable` set when `minimum-stability` is not `stable`
21. No hardcoded absolute paths in autoload
22. All repository URLs use HTTPS

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | No errors (warnings allowed unless `--strict`) |
| 1 | Errors found (or warnings in `--strict` mode) |
| 2 | Invalid arguments / file not found |

## Example Output

```
composer.json lint results
==========================
[ERROR]   name: Package name must match vendor/package format
[WARN]    dependencies: phpunit/phpunit found in require (should be in require-dev)
[WARN]    autoload: config.sort-packages not enabled
[INFO]    scripts: scripts section present

Summary: 1 error(s), 2 warning(s), 1 info
```

_meta.json Metadata

{
  "ownerId": "kn7d5eszdfwftk153ymhdm4qhs83qsqy",
  "publishedAt": 1777593642520,
  "slug": "composer-json-validator",
  "version": "1.0.1"
}