Weave Code
Codebuilder Laravel Package
keboola/codebuilder
Keboola CodeBuilder is a PHP library for programmatically generating and composing code, helping developers build reusable snippets, templates, and transformation scripts for Keboola workflows with a lightweight, consistent API.
Keboola CodeBuilder is a PHP package for programmatically assembling source code from reusable building blocks. Rather than hand-writing generated scripts, you compose templates, snippets, and components through a fluent API and let the builder produce consistent, runnable output—ideal for code generation and transformation pipelines.
- Composable builders for stacking and nesting code fragments
- Template-driven generation with placeholder substitution
- Fluent, chainable API that keeps construction readable
- Easy integration into Laravel services and CLI tooling
- Deterministic output that is simple to test and diff
Frequently asked questions about Codebuilder
- What is keboola/codebuilder used for?
- It is a small PHP library from Keboola's Generic Extractor that takes a JSON document describing a user script, including language, script body, packages, and parameters, and materializes it into an executable process. It is a thin translation layer, not a framework or service. You would only need it if you are building Keboola-compatible transformation components or an ETL runner that must accept Keboola transformation payloads.
- Is keboola/codebuilder a Laravel package?
- No. It is plain Composer/PHP and does not fight Laravel, but it ships no service provider, no config publishing, and no queue or facade integration. In a Laravel application it should sit behind a job or service boundary rather than inside a controller or request path. Treat it as a low-level dependency, not a framework extension.
- How do I install keboola/codebuilder?
- Install it with Composer using the package name keboola/codebuilder, and pin the exact version in composer.json while committing the lockfile. Before adopting it, check its PHP constraint against your runtime and inspect the transitive dependency footprint for process or console components you already use at a different version. The package is small, so integration is technically easy, but organizational risk remains.
- Does keboola/codebuilder work with PHP 8 and current Laravel releases?
- That must be verified, not assumed. The last release was in March 2022, so its composer.json likely carries PHP 7.x-era constraints that may not resolve cleanly against a modern Laravel stack. Check the PHP requirement, PSR-4 autoload correctness, and whether it assumes a Unix shell, specific interpreters, or Keboola-provided working directories and environment variables.
- Is it safe to execute user scripts with keboola/codebuilder in production?
- Its entire job is turning user-controlled data into an executed process, which is a security-critical path. Command injection, argument escaping, credential leakage into child processes, unbounded output, and timeout or zombie handling are all in scope. Use it only inside a real sandbox such as a container with restricted network egress and filesystem access, and never execute user scripts synchronously inside an HTTP request.
- Is keboola/codebuilder still maintained?
- The signals are weak for external consumers: one star, zero dependents, and no release since 30 March 2022. Keboola maintains it for its own platform, so its roadmap is not aligned with yours. That does not make it unusable, but it does mean you should plan for a vendor fork, an owned schema contract, and a 24-month build-versus-fork-versus-adopt cost review.
- What alternatives exist for running user-defined scripts in Laravel?
- If you only need to run a script from configuration, the core concern is roughly 200 lines and can be owned directly using Symfony Process or Laravel's Process facade. That gives you full control over escaping, environment scrubbing, timeouts, output caps, and exit-code handling. Adopt keboola/codebuilder only when you specifically need Keboola-compatible transformation semantics.
- How should I test code that uses keboola/codebuilder?
- Do not test against the vendor type directly in domain code. Introduce an owned interface such as ScriptRunner or TransformationExecutor, bind it in the container, and swap in a fake implementation for unit tests. Keep a small integration test that exercises one representative transformation end to end in the actual sandbox target, because the JSON schema and execution assumptions are where failures will appear.
- Does keboola/codebuilder handle timeouts, output limits, and exit codes?
- This is one of the first things to verify in a spike, because the evaluation explicitly flags it as unclear. Do not assume timeouts, output caps, stderr capture, or exit-code propagation are handled for you. If they are not, wrap the package in your own runner that enforces those limits, and document the behavior as part of your owned contract.
- How do I keep keboola/codebuilder from leaking into my domain code?
- Adopt it behind an interface you own, pin the exact version, and vendor-fork it into your namespace at first adoption rather than at first breakage. Keep a documented JSON schema contract with its own versioning so vendor drift cannot silently change behavior. This also gives you a clean migration path if the package is abandoned or replaced.
Weaver
How can I help you explore Laravel packages today?