Codingstyle Laravel Package

Getting Started

composer require --dev m6web/coke

Then run an initial audit against the ruleset the package ships:

vendor/bin/phpcs --standard=vendor/m6web/coke/coke.xml -s app/ routes/ tests/

Where to look first:

• vendor/m6web/coke/coke.xml — the actual ruleset. Read it before you argue with any sniff; every rule you'll fight about is named in that file.
• vendor/m6web/coke/composer.json — as of v1.0.5 the PHP_CodeSniffer requirement no longer lives in the package core, so this file tells you what isn't pinned for you.
• vendor/bin/phpcs -i — confirms the standard is registered and which sniffs are actually available in your installed dependency graph.

First use case: run the sniff-only pass (phpcs) over app/ with -s to print sniff codes, capture the report, and use it as a backlog. Do not start with phpcbf on a mature codebase — see the autofix note below.

Wire it into composer.json immediately so it survives the first "how do I run this again?" question:

"scripts": {
  "cs": "phpcs --standard=vendor/m6web/coke/coke.xml -s app/ routes/ tests/",
  "cs:fix": "phpcbf --standard=vendor/m6web/coke/coke.xml app/ routes/ tests/"
}

Implementation Patterns

Own the ruleset, don't reference vendor paths everywhere. Commit a project-level phpcs.xml that extends the package standard, so paths, exclusions and rule overrides live in one place:

<?xml version="1.0"?>
<ruleset name="Project">
    <file>app</file>
    <file>routes</file>
    <file>tests</file>

    <rule ref="vendor/m6web/coke/coke.xml">
        <!-- v1.0.5 excludes this upstream; re-enable if your team wants it -->
        <include name="Squiz.Strings.ConcatenationSpacing"/>
    </rule>

    <exclude-pattern>*/storage/*</exclude-pattern>
    <exclude-pattern>*/bootstrap/cache/*</exclude-pattern>
</ruleset>

Then composer cs stays short: phpcs -s picks up phpcs.xml from the project root automatically.

Re-enabling excluded rules. v1.0.5 drops Squiz.Strings.ConcatenationSpacing from the standard. If you already relied on it, the <include name="..."/> above restores it without forking the package. Conversely, if you don't care, do nothing — but be aware the rule silently stopped firing on upgrade, so a previously clean build may now pass code it would have rejected.

CI: gate on changed files, not the whole repo. Full-repo runs on a Laravel app are slow and noisy. Feed phpcs a file list:

git diff --name-only --diff-filter=ACMR origin/main...HEAD -- '*.php' \
  | xargs -r vendor/bin/phpcs --standard=phpcs.xml -s

Use --report=checkstyle (or --report=junit) for CI annotations. Exit codes matter: 1 = violations found, 2 = usage/config error (usually a bad ruleset path). Treat 2 as a broken build, not as "code is clean."

IDE integration (PhpStorm). Settings → PHP → Quality Tools → Code Sniffer: set the phpcs path to vendor/bin/phpcs, then under Inspections point the PHP CodeSniffer validation at your phpcs.xml. This is the single highest-leverage step for day-to-day use — violations show up as you type instead of in a red CI run.

Coexistence with Pint. Pint and phpcs both want to rewrite the same files. Pick an order and stick to it: Pint for formatting, phpcs for semantics. If you run both autofixers, run Pint first, then phpcbf, then phpcs to verify. Running phpcbf after Pint can reintroduce spacing changes Pint just normalised.

Pre-commit hook via CaptainHook, limited to staged files:

{ "scripts": { "pre-commit": ["vendor/bin/phpcs --standard=phpcs.xml -s {staged_files}"] } }

Blade and generated code. phpcs won't parse .blade.php meaningfully. Set --extensions=php and exclude view directories; use a separate linter for templates.

Gotchas and Tips

The dependency surface moved in v1.0.5 — pin PHP_CodeSniffer yourself. Moving squizlabs/php_codesniffer out of core means Composer is now free to resolve whatever version the rest of your graph wants. If you're on PHPCS 4.x, several 3.x sniffs changed names or behaviour. Add an explicit squizlabs/php_codesniffer constraint to require-dev and rely on composer.lock. Otherwise a routine composer update can swap your sniffer engine underneath a fixed ruleset.

The m6web/symfony2-coding-standard constraint is unlocked. This is the highest-risk line in the release. A composer update can now pull a newer major of that standard, which can add, remove, or rename sniffs — even though m6web/coke is still "1.0.5". After any update, re-run vendor/bin/phpcs -e --standard=phpcs.xml and diff the sniff list against what you had. Treat a standard bump as a code review event, not a routine update.

m6web/coke added to require (not require-dev). If you're consuming a package that now requires coke transitively, you'll inherit a coding standard in production installs. Check composer why m6web/coke before assuming it's your dev dependency. If it's coming in transitively, you may want --no-dev installs verified in CI to make sure nothing at runtime actually calls it.

Sniff codes, not human names, drive exclude/include. <exclude name="LineLength"/> fails silently. Always get the exact code with phpcs -s — the report prints Squiz.Strings.ConcatenationSpacing alongside the message.

--ignore vs <exclude-pattern>. CLI --ignore overrides the ruleset's exclude patterns rather than adding to them in some PHPCS versions. Prefer <exclude-pattern> in phpcs.xml for anything permanent; reserve --ignore for one-off local runs.

Memory and time. On large Laravel codebases phpcs will hit the default PHP memory limit. Use --memory-limit=1G in the composer script. PHPCS 3.x is single-threaded — if runtime becomes a gate, split the file list into chunks and run them in parallel rather than hoping for a flag.

phpcbf on legacy code is a trap. It's safe run-per-file, dangerous run-per-directory: it can reflow concatenations and whitespace in ways that produce a huge, unreviewable diff and occasionally break heredocs or string interpolation spacing. Run it file-by-file on code you're already touching, review the diff, commit separately from logic changes.

Exit code 2 is your friend. When a colleague reports "phpcs broke," nine times out of ten it's exit 2 — usually the standard path being resolved relative to the wrong working directory. Because the ruleset lives under vendor/, running phpcs from a subdirectory breaks the relative path. Always invoke from the project root, which composer scripts guarantee.