Install phpunit with composer require-dev not recommended?

Question

In my composer packages I add phpunit to the require-dev part of my composer.json if I have phpunit tests in my package.

Today I noticed that most of the php libraries using phpunit tests do not have listed phpunit in require-dev.

Can anybody tell me why? Is it not recommended to install phpunit with composer require-dev?

The composer documentation says

require-dev (root-only)

Lists packages required for developing this package, or running tests, etc.

so in my understanding phpunit should installed with composer require-dev

Answer 1

IMO it's right and convenient to add phpunit as a require-dev dependency.

As an example it's added in the Doctrine composer.json:

https://github.com/doctrine/doctrine2/blob/master/composer.json

Answer 2

I have been thinking recently a lot lately about that. (That's why I came here.)

It all comes from the Continuous Delivery book ( https://www.amazon.com/gp/product/B003YMNVC0/ref=kinw_myk_ro_title ).

There it states that you build an "artifact" from a commit in your code. And that you should use the exact same artifact to go through the pipeline. The pipeline is a set of stages that basically test the artifact in all the possible ways reaching the final stage where it's deployed to production.

So it's important that the artifact is the same for each stage, to make sure that what you deploy to production is what has been tested through all the pipeline. If you build the artifact at each stage you can't assure that.

Building the artifact for many projects would be a docker image, with a Dockerfile that basically does a "composer install". Now, if you put phpunit on the require-dev, and then build, composer install with --no-dev, you won't be able to test the artifact with phpunit on the pipeline (or somehow you install phpunit the CI server and you make it independent from the build, which might be the solution to my problem).

You can build two artifacts, one with phpunit and one without, but then you can't be 100% sure that the artifact passed all the tests, since you are testing another artifact actually (what if something crucial operation in your code was using a package listed on the dev by error, so it passed the tests, but then deploying to production the other artifact without the dev packages it starts failing?. - that could be solved by not using phpunit for your acceptance/functional/whatever-you-want-to-call-them tests).

So I believe that's the reason many projects put phpunit not under require-dev, but on regular require, so they build it once, and then go through the pipeline with the exact same artifact. They just end up having phpunit in the production running application though. If they can afford it because there's enough disk room or other, I guess there's no harm.