Weave Code
Vipwpcs Laravel Package
automattic/vipwpcs
PHP_CodeSniffer sniffs and rulesets for validating WordPress VIP code. Includes WordPressVIPMinimum for the older WordPress.com VIP platform and WordPress-VIP-Go for VIP Go, flagging errors and warnings per VIP documentation.
PHP_CodeSniffer ruleset to enforce WordPress VIP coding standards.
Frequently asked questions about Vipwpcs
- What is automattic/vipwpcs and does it work with Laravel?
- automattic/vipwpcs is a PHP_CodeSniffer ruleset that enforces WordPress VIP coding standards, not a Laravel package. It ships two standards, WordPressVIPMinimum for the legacy WordPress.com VIP platform and WordPress-VIP-Go for VIP Go. Laravel teams can install it as a dev-only Composer dependency for CI, but its sniffs target WordPress APIs, so expect limited relevant signal on typical Laravel code.
- How do I install automattic/vipwpcs in a Laravel project?
- Run composer config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true, then composer require --dev automattic/vipwpcs. Since version 2.3.0 the Composer installer plugin is a dependency of VIPCS itself, but Composer 2.2 and higher still requires you to grant permission for it to run. Point a phpcs.xml.dist at WordPress-VIP-Go or WordPressVIPMinimum and run vendor/bin/phpcs.
- Which ruleset should I use: WordPressVIPMinimum or WordPress-VIP-Go?
- Use WordPressVIPMinimum only for projects on the older WordPress.com VIP platform. Use WordPress-VIP-Go for the newer VIP Go platform. The rulesets contain only rules classified as errors or warnings per WordPress VIP documentation, so choose the one matching the platform you actually deploy to.
- Does automattic/vipwpcs conflict with Laravel Pint?
- There is no dependency-level conflict because Laravel Pint wraps PHP-CS-Fixer while VIPCS plugs into PHP_CodeSniffer. The two tools can still report overlapping style findings in different shapes, which creates confusion about which one is authoritative. Assign style ownership to exactly one tool, or scope PHPCS to VIP-specific sniffs only.
- What PHP and PHPCS versions does automattic/vipwpcs require?
- The README lists PHP 7.4+, PHPCS 3.13.5+, PHPCSUtils 1.2.3+, PHPCSExtra 1.5.1+, WPCS 3.4.1+, and VariableAnalysis 2.13.0+ as minimums. Composer resolves these transitively when you require the package. Check these floors against your existing CI image and any other PHPCS consumers before pinning.
- Is automattic/vipwpcs useful for a non-WordPress Laravel codebase?
- On a non-WordPress Laravel codebase the ruleset mostly emits noise because its sniffs cover WP_Query misuse, object-cache behavior, hook contracts, and wp_ function restrictions. A noisy quality gate typically gets disabled rather than fixed. Its better use is as a reference for composing a bespoke Laravel PHPCS standard on top of PSR-12 or Laravel conventions.
- What license does automattic/vipwpcs use and can I fork it?
- Repository metadata reports NOASSERTION, while LICENSE.md states GPL-2.0-or-later, so treat licensing as unresolved until confirmed. GPL is generally acceptable for a dev-only CI tool that is not redistributed with your product. Vendoring, forking into a distributed artifact, or embedding sniffs in a shipped package needs legal sign-off first.
- How do I run automattic/vipwpcs in CI and fail the build on errors?
- Run vendor/bin/phpcs with a machine-readable report such as checkstyle or JSON so your CI can annotate findings. Decide explicitly whether errors fail the build and warnings only annotate, matching the VIP error-versus-warning model. A common rollout is a non-blocking first pass, then promote to blocking once the baseline is clean.
- What dependencies does automattic/vipwpcs pull in?
- VIPCS pulls PHP_CodeSniffer, PHPCSUtils, PHPCSExtra, WordPress Coding Standards, and VariableAnalysis transitively. Minimum-version bumps have historically been forced by upstream PHP 8.2 and 8.3 support, which can collide with other PHPCS consumers in a large monorepo. Pin versions deliberately and test upgrades in your CI image.
- Is automattic/vipwpcs actively maintained and which version should I pin?
- The recorded last release date appears ahead of the review date, so treat release cadence claims as unverified and confirm tags on Packagist or the repository. Pin a known-good version and review changelogs before upgrading, especially for PHPCS minimum-version bumps. If you need a fork, resolve the GPL question and ownership first.
Weaver
How can I help you explore Laravel packages today?