Composer config.platform PHP version mismatch lacks runtime warnings

There is currently no native Composer configuration flag that triggers a warning or error when the config.platform PHP version is set higher than the actual runtime environment. By design, the platform override tells Composer to ignore the local environment and assume a specific version for dependency resolution, which effectively silences the mismatch.

Understanding the Behavior

The config.platform-check setting (which defaults to true) generates a platform_check.php file in the vendor directory. However, this check validates the environment against the resolved requirements of your packages, not against the spoofed version defined in your composer.json. If you override the platform to PHP 8.2 while running PHP 8.1, Composer resolves packages for 8.2; if those packages then require 8.2 features, the runtime check will fail, but the composer install process itself will not warn you about the override discrepancy.

Diagnostic Capabilities

While composer diagnose does not explicitly flag the mismatch as an error, it provides the necessary data to identify it manually. It lists both the detected runtime PHP version and the configured platform settings. Similarly, composer validate --strict ensures the composer.json is syntactically correct but does not validate the logic of the platform override against the current shell.

Recommended Detection Method

To prevent local builds from succeeding when the override exceeds the runtime, you must implement an external check in your CI pipeline or a git pre-commit hook. A minimal PHP script can verify this mismatch:

<?php
$config = json_decode(file_get_contents('composer.json'), true);
$platformPhp = $config['config']['platform']['php'] ?? null;

if ($platformPhp && version_compare($platformPhp, PHP_VERSION, '>')) {
    fprintf(STDERR, "Warning: Platform override (%s) exceeds runtime PHP (%s)\n", $platformPhp, PHP_VERSION);
    exit(1);
}
?>

Verification Steps

1. Run composer diagnose and manually compare the "PHP version" line with your composer.json platform config.
2. Run composer validate --strict to confirm that the override is accepted as valid metadata despite the runtime difference.
3. Execute the script above to confirm it catches the mismatch in your specific environment.

Missing Diagnostic Detail: Are you utilizing a specific CI runner (e.g., GitHub Actions, GitLab CI) where this check should be integrated? The recommendation for implementation varies between a local hook and a pipeline stage.