fix: keep phpmetrics composer analysis bounded

Author: coisa

CHANGELOG.md

@@ -14,7 +14,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 
-- Preserve color-friendly nested command environments, explicit Symfony Console ANSI flags, concise process section labels, and offline-safe PhpMetrics execution without restoring PTY (#239)
+- Preserve color-friendly nested command environments, explicit Symfony Console ANSI flags, concise process section labels, and fixture-safe PhpMetrics execution with bounded Packagist lookups without restoring PTY (#239)
 - Disable Xdebug for queued child processes unless coverage requires it without PCOV, reducing repeated Composer Xdebug warnings in orchestrated commands (#239)
 - Keep the reports workflow permission warning loop shell-safe for paths containing backslashes (#244)
 - Keep required PHPUnit matrix checks reporting after workflow-managed `.github/wiki` pointer commits by running the pull-request test workflow without top-level path filters and aligning the packaged consumer test wrapper (#230)

docs/commands/metrics.rst

@@ -33,7 +33,7 @@ Options
    Comma-separated directories that should be excluded from analysis.
 
    Default:
-   ``vendor,test,tests,tmp,cache,spec,build,.dev-tools,backup,resources``.
+   ``vendor,tmp,cache,spec,build,.dev-tools,backup,resources,tests/Fixtures``.
 
 ``--target=<directory>``
    Output directory for the generated metrics reports.
@@ -94,5 +94,8 @@ Behavior
   running PhpMetrics in a quieter mode to avoid polluting the captured payload;
 - it runs PhpMetrics through the active PHP binary and suppresses PhpMetrics
   deprecation notices emitted by the dependency itself;
-- it disables PhpMetrics' Composer package freshness lookup so metrics runs do
-  not block on Packagist availability or local network state.
+- it keeps PhpMetrics' Composer analysis enabled so the reports include package
+  metadata from the root ``composer.json`` and ``composer.lock``, while the
+  default exclusions keep nested fixture projects out of that Composer scan;
+- it limits PhpMetrics' per-package Packagist socket wait so package freshness
+  enrichment cannot leave metrics generation stuck indefinitely.

docs/running/specialized-commands.rst

@@ -133,8 +133,11 @@ Important details:
   available;
 - it suppresses deprecation notices emitted by the PhpMetrics dependency
   itself so the command output stays readable;
-- it disables PhpMetrics' Composer package freshness lookup so report
-  generation does not depend on Packagist connectivity.
+- it keeps PhpMetrics' Composer analysis enabled so report generation includes
+  root package metadata, while default exclusions keep nested fixture projects
+  out of that Composer scan;
+- it limits PhpMetrics' per-package Packagist socket wait so package freshness
+  enrichment cannot leave report generation stuck indefinitely.
 
 ``code-style``
 --------------

src/Console/Command/MetricsCommand.php

@@ -50,6 +50,11 @@ final class MetricsCommand extends BaseCommand implements LoggerAwareCommandInte
      */
     private const int PHP_ERROR_REPORTING = \E_ALL & ~\E_DEPRECATED;
 
+    /**
+     * @var int the maximum seconds PhpMetrics may wait on each Packagist package lookup
+     */
+    private const int PHP_DEFAULT_SOCKET_TIMEOUT = 1;
+
     /**
      * @param ProcessBuilderInterface $processBuilder the builder used to assemble the PhpMetrics process
      * @param ProcessQueueInterface $processQueue the queue used to execute the PhpMetrics process
@@ -80,7 +85,7 @@ protected function configure(): void
                 name: 'exclude',
                 mode: InputOption::VALUE_OPTIONAL,
                 description: 'Comma-separated directories that SHOULD be excluded from analysis.',
-                default: 'vendor,test,tests,tmp,cache,spec,build,.dev-tools,backup,resources',
+                default: 'vendor,tmp,cache,spec,build,.dev-tools,backup,resources,tests/Fixtures',
             )
             ->addOption(
                 name: 'target',
@@ -118,7 +123,6 @@ protected function execute(InputInterface $input, OutputInterface $output): int
         $processBuilder = $this->processBuilder
             ->withArgument('--ansi')
             ->withArgument('--git', 'git')
-            ->withArgument('--composer', 'false')
             ->withArgument('--exclude', $exclude)
             ->withArgument('--report-html', $target)
             ->withArgument('--report-json', $target . '/report.json')
@@ -135,7 +139,12 @@ protected function execute(InputInterface $input, OutputInterface $output): int
         $this->processQueue->add(
             process: $processBuilder
                 ->withArgument('.')
-                ->build([\PHP_BINARY, '-derror_reporting=' . self::PHP_ERROR_REPORTING, self::BINARY]),
+                ->build([
+                    \PHP_BINARY,
+                    '-derror_reporting=' . self::PHP_ERROR_REPORTING,
+                    '-ddefault_socket_timeout=' . self::PHP_DEFAULT_SOCKET_TIMEOUT,
+                    self::BINARY,
+                ]),
             label: 'Generating Metrics with PhpMetrics',
         );
 

tests/Console/Command/MetricsCommandTest.php

@@ -73,7 +73,7 @@ protected function setUp(): void
         $this->process = $this->prophesize(Process::class);
 
         $this->input->getOption('exclude')
-            ->willReturn('vendor,tests');
+            ->willReturn('vendor,tests/Fixtures');
         $this->input->getOption('target')
             ->willReturn(ManagedWorkspace::getOutputDirectory(ManagedWorkspace::METRICS));
         $this->input->getOption('junit')
@@ -94,10 +94,10 @@ protected function setUp(): void
         $this->processBuilder->withArgument(Argument::any(), Argument::any())->willReturn(
             $this->processBuilder->reveal()
         );
-        $this->processBuilder->withArgument('--composer', 'false')
-            ->willReturn($this->processBuilder->reveal())
-            ->shouldBeCalled();
-        $this->processBuilder->build(Argument::any())->willReturn($this->process->reveal());
+        $this->processBuilder->build(Argument::that(static fn(array $command): bool => \PHP_BINARY === $command[0]
+            && str_starts_with((string) $command[1], '-derror_reporting=')
+            && '-ddefault_socket_timeout=1' === $command[2]
+            && 'vendor/bin/phpmetrics' === $command[3]))->willReturn($this->process->reveal());
         $this->processQueue->add($this->process->reveal(), Argument::cetera())
             ->shouldBeCalled();