Php Codesniffer Sniffs Laravel Package

Technical Evaluation

Architecture Fit

• Purpose Alignment: Remains aligned with enforcing consistent coding standards in Laravel/PHP via static analysis, but now supports Slevomat Coding Standard (v8.26.0) in addition to PHP_CodeSniffer. This expands compatibility with modern PHP tooling ecosystems (e.g., projects using slevomat/coding-standard for stricter PSR rules or custom sniffs).
• Non-Invasive: Still augments existing tooling without modifying core Laravel/PHP functionality. However, dual support for two sniffing frameworks (PHP_CodeSniffer + Slevomat) introduces minor architectural complexity in configuration.
• Customizability: Retains granular control via configuration files (e.g., phpcs.xml or Slevomat’s coding-standard.neon), but teams must now decide between one or both frameworks for consistency. Risk of rule duplication if both are used.

Integration Feasibility

• Tooling Compatibility:
  • PHP_CodeSniffer: Unchanged (v3+).
  • Slevomat Coding Standard: New support for v8.26.0, enabling integration with projects using slevomat/coding-standard (e.g., for stricter PSR-22/PSR-12 enforcement or custom rules).
  • Laravel-Specific Use Cases: Unchanged, but Slevomat’s stricter defaults may conflict with Laravel idioms (e.g., Facade usage, dynamic method calls). Requires explicit configuration to avoid false positives.
• Dual-Framework Overhead: Teams must now choose between:
  • PHP_CodeSniffer (traditional, Laravel-friendly).
  • Slevomat (stricter, but may require exceptions for Laravel patterns).
  • Hybrid approach: Use both in parallel (e.g., PHP_CodeSniffer for Laravel sniffs, Slevomat for PSR compliance), increasing CI complexity.

Technical Risk

• Rule Overlap/Conflict:
  • New Risk: Slevomat’s stricter PSR rules may flag valid Laravel code (e.g., app() helper usage, Facade static calls). Requires thorough testing and configuration tweaks.
  • Example Conflict: Slevomat’s Classes\ClassLength sniff might misfire on Laravel’s Illuminate\Support\Facades\Facade class.
• Dependency Bloat: Adding slevomat/coding-standard as a dependency increases composer lock complexity and potential version conflicts.
• Maintenance Burden:
  • Dual Configuration: Teams must maintain two sets of rules (phpcs.xml + coding-standard.neon) or merge them, risking drift.
  • Framework-Specific Updates: PHP_CodeSniffer and Slevomat may evolve at different paces, requiring parallel updates.
• Performance: Slevomat’s stricter analysis may increase CI runtime. Benchmark both frameworks to compare.

Key Questions

1. Framework Preference:
   • Should the team standardize on PHP_CodeSniffer (Laravel-friendly) or migrate to Slevomat (stricter PSR compliance)?
   • If hybrid, how will rule conflicts be resolved (e.g., prioritize one framework over the other)?
2. Laravel-Specific Sniffs:
   • Are the package’s Laravel sniffs tested with Slevomat? If not, will they produce false positives?
   • Example: Does it handle Laravel’s Str:: helper or Route:: macros correctly under Slevomat?
3. Configuration Strategy:
   • How will phpcs.xml and coding-standard.neon be synchronized to avoid redundancy?
   • Should exceptions for Laravel patterns be documented in both configs?
4. CI/CD Impact:
   • Will dual-framework checks double CI runtime? Should they run in parallel or sequentially?
   • Example GitHub Actions setup:

     - name: Run PHP_CodeSniffer
       run: vendor/bin/phpcs --standard=./vendor/moxio/php-codesniffer-sniffs app/
     - name: Run Slevomat Coding Standard
       run: vendor/bin/ecs check --config=ecs.php src/
     

5. Deprecation Risk:
   • Is PHP_CodeSniffer support being deprecated in future releases? (Check roadmap.)
   • Is Slevomat’s v8.26.0 the latest stable version, or are breaking changes expected?
6. Blade Template Support:
   • Does Slevomat integration extend to Blade templates, or is it PHP-only? If the latter, how will template standards be enforced?

Integration Approach

Stack Fit

• Dual-Framework Support:
  • PHP_CodeSniffer: Ideal for Laravel-specific sniffs (e.g., Facade usage, Eloquent patterns).
  • Slevomat Coding Standard: Ideal for strict PSR compliance or custom project rules.
  • Recommendation: Use one primary framework unless both are explicitly needed.
• Tooling Ecosystem:
  • Local Development:
    • PHP_CodeSniffer: Integrate with PHPStorm/VSCode via phpcs plugin.
    • Slevomat: Use ecs CLI or IDE plugins (e.g., PHP Inspections for Slevomat).
  • CI/CD:
    • Option 1: Run both frameworks in parallel (higher CI cost).
    • Option 2: Migrate entirely to Slevomat (if PHP_CodeSniffer sniffs are ported).
  • Pre-Commit Hooks: Use husky to run either phpcs or ecs (not both).
• Laravel-Specific Tools:
  • Complement laravel-pint (formatting) or pestphp/pest (testing) without redundancy.
  • Avoid overlap with dealerdirect/phpcodesniffer-composer (Laravel-specific sniffs).

Migration Path

1. Assessment Phase:
   • Audit current phpcs.xml and identify conflicting rules with Slevomat’s defaults.
   • Test both frameworks on a subset of the codebase to compare false positives/negatives.
   • Example command to test Slevomat:

     vendor/bin/ecs check --config=ecs.php --fix app/  # Dry run with auto-fix
     

2. Pilot Phase:
   • Option A (PHP_CodeSniffer): Proceed as in v2.6.4, but document Slevomat as a future migration path.
   • Option B (Slevomat): Enable Slevomat in CI as a warning-only check for 30 days.
     • Configure ecs.php to ignore Laravel-specific patterns (e.g., Facade static calls).
     • Example ecs.php snippet:

       return [
           'rules' => [
               // Disable rules that conflict with Laravel
               \SlevomatCodingStandard\Sniffs\Classes\ClassLengthSniff::class => false,
               \SlevomatCodingStandard\Sniffs\Functions\FunctionLengthSniff::class => [
                   'max' => 100, // Relax for Laravel controllers
               ],
           ],
       ];
       

3. Full Rollout:
   • If using Slevomat:
     • Update CI to fail builds on violations (start with warnings).
     • Migrate phpcs.xml rules to ecs.php where possible.
   • If using PHP_CodeSniffer:
     • Ignore Slevomat support and treat it as a legacy compatibility layer.

Compatibility

• PHP_CodeSniffer: Unchanged (v3+).
• Slevomat Coding Standard: Requires v8.26.0 (pin version in composer.json):

  "require-dev": {
      "slevomat/coding-standard": "^8.26.0"
  }
  

• Laravel Version: Test with the project’s Laravel version to confirm no false positives (e.g., sniffs misfiring on Laravel’s internal code).
• Dependency Conflicts:
  • Avoid conflicts with other sniff packages (e.g., symplify/easy-coding-standard).
  • Use composer why-not to check for version conflicts.

Sequencing

1. Phase 1: Framework Selection
   • Decide: PHP_CodeSniffer, Slevomat, or hybrid.
   • Document rationale in CONTRIBUTING.md.
2. Phase 2: Configuration
   • PHP_CodeSniffer: Update phpcs.xml to include new sniffs.
   • Slevomat: Create ecs.php with Laravel-specific exceptions.
3. Phase 3: CI Integration
   • Add to GitHub Actions/GitLab CI:

     - name: Run Slevomat Coding Standard
       run: vendor/bin/ecs check --config=ecs.php --parallel=4 app/
     

   • Parallel execution: Use --parallel to reduce runtime.
4. Phase 4: IDE Integration