From 0338647e343a04669dd6293799b13bf359e83bc1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20Uzna=C5=84ski?= <lukaszuznanski94@gmail.com>
Date: Wed, 7 Oct 2020 14:10:44 +0200
Subject: [PATCH] [TASK] Remove security checker (#111)

Resolves: #110
---
 .github/workflows/ci.yml | 25 -------------------------
 README.md                |  9 +++++++++
 composer.json            |  2 --
 3 files changed, 9 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 705e317..237357a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -197,28 +197,3 @@ jobs:
         typo3-version:
           - ^9.5
           - ^10.4
-  security-test:
-    name: "PHP Security test"
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        php-version:
-          - 7.4
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v2
-      - name: "Install PHP"
-        uses: shivammathur/setup-php@v2
-        with:
-          php-version: "${{ matrix.php-version }}"
-      - name: "Cache dependencies installed with composer"
-        uses: actions/cache@v1
-        with:
-          key: "php${{ matrix.php-version }}
-               -composer-${{ hashFiles('**/composer.json') }}"
-          path: ~/.composer/cache
-          restore-keys: "php${{ matrix.php-version }}-composer-\n"
-      - name: "Install Composer dependencies"
-        run: "composer install --no-progress"
-      - name: "Run PHP Security test"
-        run: "composer ci:security"
diff --git a/README.md b/README.md
index afb483c..3e84489 100644
--- a/README.md
+++ b/README.md
@@ -79,6 +79,15 @@ For creating new extensions, I recommend taking
 [Helmut Hummel's extension skeleton](https://github.com/helhum/ext_scaffold)
 as a starting point.
 
+## Security
+
+Libraries and extensions do not need the security check as they should not have
+any restrictions concerning the other libraries they are installed alongside with
+(unless those would create breakage), and they also do not have a `composer.lock`
+which usually is the source for security checks.
+
+Instead, the projects (i.e., for TYPO3 installations) need to have the security checks.
+
 ## More Documentation
 
 * [Handout to my workshops on test-driven development (TDD)](https://github.com/oliverklee/tdd-reader)
diff --git a/composer.json b/composer.json
index e1bf548..2e4e8ec 100644
--- a/composer.json
+++ b/composer.json
@@ -42,7 +42,6 @@
         "typo3/cms-fluid-styled-content": "^9.5 || ^10.4",
         "seld/jsonlint": "^1.8",
         "phpdocumentor/reflection-docblock": "<= 5.1 || > 5.2",
-        "sensiolabs/security-checker": "^6.0",
         "j13k/yaml-lint": "1.1.x-dev"
     },
     "replace": {
@@ -75,7 +74,6 @@
         "ci:ts:lint": ".Build/vendor/bin/typoscript-lint -c Configuration/TsLint.yml --ansi -n --fail-on-warnings -vvv Configuration/TypoScript",
         "ci:tests:unit": ".Build/vendor/bin/phpunit -c .Build/vendor/nimut/testing-framework/res/Configuration/UnitTests.xml Tests/Unit",
         "ci:tests:functional": "find 'Tests/Functional' -wholename '*Test.php' | parallel --gnu 'echo; echo \"Running functional test suite {}\"; .Build/vendor/bin/phpunit -c .Build/vendor/nimut/testing-framework/res/Configuration/FunctionalTests.xml {}';",
-        "ci:security": ".Build/vendor/bin/security-checker security:check",
         "ci:tests": [
             "@ci:tests:unit",
             "@ci:tests:functional"