Getting Started

Start by installing the package as a dev dependency in your project using Composer:

composer config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true
composer require --dev automattic/vipwpcs

This automatically registers the WordPress-VIP-Go and WordPressVIPMinimum standards with PHPCS. After installation, run:

./vendor/bin/phpcs -i

to confirm WordPress-VIP-Go and WordPressVIPMinimum appear in the list of installed standards. Your first real use case is linting your codebase:

./vendor/bin/phpcs --standard=WordPress-VIP-Go path/to/your/plugin.php

Check the VIP docs on PHPCS reports to understand error/warning severity and how to interpret results.

Implementation Patterns

CI Integration: Use in GitHub Actions or GitLab CI to fail builds on violations. A typical workflow step:
```
- name: Run VIP Coding Standards
  run: ./vendor/bin/phpcs --standard=WordPress-VIP-Go --extensions=php --severity=5 .
```
Adjust --severity and --warning-severity to balance strictness and developer feedback.
Editor Integration: Configure VS Code (with PHPCS extension) or PHPStan/PSR support to use the VIP ruleset via phpcs.standard: "WordPress-VIP-Go".
Custom Ruleset: Extend the provided rulesets for project-specific tweaks: create phpcs.xml with:
```
<?xml version="1.0"?>
<ruleset name="MyVIP">
  <rule ref="WordPress-VIP-Go"/>
  <exclude name="WordPressVIPMinimum.Security.EscapeOutput.OutputNotEscaped"/>
</ruleset>
```
⚠️ As of v2.3.0, do not override the escaping_function property in custom rulesets—it’s disallowed.
Test Suite Integration: Run PHPCS as part of your test suite via ./vendor/bin/phpcs in composer test scripts or phpunit.xml via phpcs test runner.
Legacy Projects: Use WordPressVIPMinimum for old wp.com VIP projects; prefer WordPress-VIP-Go for modern VIP Go deployments (the default).

Breaking changes in v2.2.0+: If you have WordPressVIPMinimum.Variables.Variables references in config or inline @phpcs:ignore, replace with VariableAnalysis.CodeAnalysis.VariableAnalysis.
Escaping sniff changes in v2.3.0: The ProperEscapingFunction sniff was improved but now doesn’t allow overriding of escaping_function—remove any such config.
False positives on VariableAnalysis: Silence UnusedVariable per PR #620 to reduce noise—this is already done by default in the ruleset.
File includes: IncludingNonPHPFile now recognizes .phar and interpolated strings—be precise with constants used in include/require to avoid false positives. Use $allowedKeywords to tune.
WP_Query sniffs: WPQueryParams now flags 'exclude'—verify usage; it may be legitimate for complex tax queries.
Output escaping: Pay close attention to ProperEscapingFunction for action attributes on <form> tags and URL/HTML attribute context detection—it’s strict but covers common XSS pitfalls.
Global install caveat: If installed globally, always run phpcs -i to verify VIP standards are registered—Composer plugins may conflict if multiple PHPCS standards are used.

Debugging: Use --debug with PHPCS to see which sniffs fire and why:

./vendor/bin/phpcs --standard=WordPress-VIP-Go --debug file.php 2>&1 | grep -A1 'fired'