- How do I install msamgan/laravel-env-keys-checker in a Laravel project?
- Install it with Composer as a dev dependency using composer require --dev msamgan/laravel-env-keys-checker. Laravel package auto-discovery registers the service provider and the Artisan command, so no manual wiring is normally required. If your application has discovery disabled, add the provider to config/app.php yourself. After installing, confirm the exact command name and options in the README rather than assuming.
- Which Laravel and PHP versions does version 2.0.0 support?
- Version 2.0.0 is a major bump whose only substantive runtime change is Laravel 13 compatibility, which strongly implies the minimum supported Laravel and PHP versions were raised. Read the released composer.json constraints for laravel/framework, illuminate/*, and php before upgrading. If your application runs an older Laravel line, pin ^1.9.1 instead; the core checking behaviour is unchanged, so deferring the major version costs you nothing.
- Should I install it as a dev dependency or a production requirement?
- Install it with --dev. It is single-purpose developer and CI tooling that adds an Artisan command and has no request-path footprint, so it should not enter your production runtime dependency graph. Keeping it in require-dev also means it stays out of the installed package set in optimised production builds.
- How do I run the check and what do the exit codes mean?
- You run it through an Artisan command that compares environment keys across your .env files and reports missing or extra variables. Exit-code semantics are what decide whether a CI step passes or fails, so verify the signature, output format, and return codes in the source or README before building automation around them. Run it manually in one repository first and observe the real output.
- Can I use it as a blocking gate in my deployment pipeline?
- Yes, but stage it. Add it to CI as a non-blocking, warn-only step for one or two sprints and capture what it flags, then promote it to a blocking gate only once the false-positive rate is acceptably low. Because it is a pre-flight validation check rather than a runtime dependency, keep it off the critical path of the deploy itself.
- Does it detect environment keys referenced dynamically, like env($var) inside a loop?
- Dynamically constructed key names, values pulled from config cache output, and keys assembled at runtime are the likely weak spot for any static comparison tool. Add a known dynamic reference to a pilot repository and see whether the checker reports it. Treat anything unresolved as needing manual review instead of assuming the check is exhaustive.
- Can it compare multiple .env files, not just .env and .env.example?
- The package is described as checking whether all keys are available across all your .env files, which is where it earns its place in multi-environment setups. Check the README and any publishable config file for how file paths and target files are declared. Verify the behaviour against your actual file layout in one repository before depending on it.
- What are the alternatives to laravel-env-keys-checker?
- You can write a short custom Artisan command that parses both files and diffs the key arrays, use a shell diff over extracted key names, or adopt a broader environment management package. A naive diff is quick, but correctly handling comments, quoted values, and several .env files is where a dedicated package pays off. Evaluate this one against a hand-rolled command for your specific conventions.
- What changed between 1.9.1 and 2.0.0, and is upgrading worth it?
- The substantive changes are a Dependabot bump to a CI-only GitHub Action and Laravel 13 compatibility contributed by Laravel Shift, with no new features, deprecations, or stated bug fixes. Because it is a major version, assume the Laravel and PHP floor moved. If you already meet the new floor, upgrade it alongside your Laravel 13 upgrade rather than as a separate event.
- Is the package actively maintained, and what is the maintenance risk?
- It is a single-maintainer package, so bus-factor concentration is the dominant long-term concern. Automated Dependabot activity and framework-compatibility automation are positive hygiene signals, but they are not the same as active feature development. Pin a version, record the supported Laravel and PHP matrix in your dependency register, and keep a small in-house fallback check in mind.