Weave Code
Coverage Laravel Package
codacy/coverage
Deprecated PHP coverage reporter that sends PHPUnit coverage results (Clover XML, or PHPUnit XML for PHPUnit <4) to your Codacy dashboard. No longer maintained; use the codacy-coverage-reporter instead.
Phar for uploading PHP code coverage to Codacy
Frequently asked questions about Coverage
- What is codacy/coverage used for?
- codacy/coverage is a small CLI tool that parses PHPUnit coverage output and uploads it to your Codacy dashboard using a project token and commit identifier. It accepts Clover XML, or legacy PHPUnit XML for PHPUnit versions below 4. It runs entirely in CI and has no Laravel service provider, facade, config file, or Artisan commands.
- Does codacy/coverage work with Laravel 10 or 11?
- No supported Laravel release is targeted. The package declares PHP 5.3 or later and legacy PHPUnit input formats, while Laravel 10 and 11 require PHP 8.1 or 8.2 with PHPUnit 10 or 11, or Pest 2 or 3. Clover-only uploads may still run on PHP 8.x, but that path is untested and unsupported, and the repository is archived.
- Is codacy/coverage still maintained?
- No. The repository is archived and the README explicitly marks it as deprecated. The last release was on 2020-01-10, it has 45 stars and zero dependents. The vendor directs users to codacy-coverage-reporter instead.
- How do I install codacy/coverage in a Laravel project?
- Historically you added codacy/coverage dev-master to require-dev or downloaded the prebuilt phar. Both approaches are problematic for modern governed repositories: dev-master is an unpinned, mutable dependency, and a bundled phar hides its dependencies from Composer audit. For any new or maintained Laravel project, do not adopt this package.
- What should I use instead of codacy/coverage for Laravel?
- Use codacy-coverage-reporter, the official replacement recommended by Codacy. Keep generating Clover XML with PHPUnit and point the maintained reporter at that file in CI. The swap is cheap because Clover is the durable part and the uploader is replaceable.
- How do I send PHPUnit coverage results to Codacy from Laravel?
- Generate a Clover report with phpunit --coverage-clover build/logs/clover.xml, or configure the clover block under coverage and report in phpunit.xml. Then run the reporter in CI with CODACY_PROJECT_TOKEN and the commit SHA available as environment variables. The old codacy/coverage tool expects a single coverage file and offers no merge capability.
- Does codacy/coverage support Laravel parallel test runs?
- No. Laravel's php artisan test --parallel and ParaTest produce multiple coverage artifacts, but the reporter expects one input file. You would need to merge coverage output before upload, and this tool provides no merge feature. Parallel test execution is a common reason teams move to a maintained reporter.
- What are the security risks of using codacy/coverage in CI?
- It is an abandoned dev-master phar that executes in CI with access to your Codacy project token. Composer audit and outdated tooling cannot inspect or patch the dependencies bundled inside the phar, and there is no security response path from the maintainer. Treat it as a standing audit finding rather than a safe dev-only dependency.
- Which coverage report formats does codacy/coverage accept?
- It accepts Clover XML, typically produced by PHPUnit --coverage-clover, and legacy PHPUnit XML only for PHPUnit versions below 4. Modern Laravel stacks use PHPUnit 10 or 11, or Pest, so only Clover is relevant. Clover is also the format consumed by replacement reporters, which makes an exit path straightforward.
- Should I add codacy/coverage to a new Laravel project?
- No. It is archived, unsupported, pins an unpinned dev-master dependency, and adds no framework-level value to the application. If Codacy coverage is a hard requirement, use codacy-coverage-reporter or another maintained uploader. If it is only a nice-to-have dashboard, deprioritize it entirely.
Weaver
How can I help you explore Laravel packages today?