Option to only check production dependencies

[func0der]

I was wondering if there should be a --production flag (or similar) to only check require and not require-dev.

In many cases you can use software locally, but not distribute it with your application without using the same license etc.
So it would be totally fine to have dev dependencies with those licenses, since one would (probably) not ship with them.

The option would live on the same level as enforce in the composer.json.

What do you think about that?

[arokettu]

A good suggestion but, well, it would be trivial for licenses:scan but the actual enforcement logic happens at a stage when the code doesn't know what package is dev and what is not. If it is possible it requires hooking to a different event and a major rewrite as a result