- What is nunomaduro/skeleton-php and what is it used for?
- nunomaduro/skeleton-php is a repository template from Nuno Maduro for bootstrapping new PHP packages. It provides a conventional src/ and tests/ layout, testing and static-analysis setup, a CI workflow, and baseline docs so you can skip boilerplate. It is not a runtime library, so you consume it by cloning or using it as a GitHub template rather than requiring it in an application. Its value is a clean starting point, not runtime functionality.
- Should I install nunomaduro/skeleton-php with Composer require?
- No. You should not add nunomaduro/skeleton-php as a require or require-dev dependency; it is a template, not a library. Adding it to composer.json creates a meaningless dependency and confuses future audits. Use composer create-project or GitHub's Use this template instead, then rewrite the generated composer.json for your package.
- Does nunomaduro/skeleton-php support Laravel packages?
- It is a generic PHP package skeleton, not a Laravel-specific one, but it is a reasonable base for Laravel packages. You will need to add Laravel-specific pieces yourself, such as a service provider, optional facade, config publishing, package discovery metadata, and an Orchestra Testbench test harness. If most of your packages are Laravel integrations, consider a Laravel-oriented skeleton or an internal template with those stubs baked in.
- Which PHP and Laravel versions does the skeleton support?
- There is no semver contract or fixed support matrix because the skeleton is a template you fork and own. The defaults typically target PHP 8.x and current PHPUnit/PHPStan majors, but you must check the composer.json and CI matrix in the commit you use. For Laravel support, the constraint comes from your package's own composer.json, not from the skeleton itself. Align the PHP and Laravel matrix to your organization's policy before promoting the fork internally.
- How do I create a new package from this skeleton?
- Run composer create-project nunomaduro/skeleton-php your/package-name or click Use this template on GitHub. Then rename the Composer package and namespace, replace author-specific branding, update the LICENSE and README, and align PHPUnit, PHPStan, and code-style versions to your policy. Harden the generated GitHub Actions workflow with pinned action SHAs and a least-privilege GITHUB_TOKEN before the first release.
- What testing and tooling is included in nunomaduro/skeleton-php?
- The skeleton bundles a conventional package structure plus a testing setup, static analysis with PHPStan, code style tooling, and a GitHub Actions CI workflow. It also includes baseline files like LICENSE and README so the repository is presentable from day one. Exact tool versions and opinions reflect the author's workflow, so review and adjust them to match your engineering standards rather than adopting them wholesale.
- Is nunomaduro/skeleton-php safe to use in production?
- The production risk is low because the skeleton is developer tooling and does not enter your application's runtime dependency graph. The real risk is process-related: template drift, unpinned CI actions, stale dev dependencies, and opinionated defaults that may fork your standards. Treat generated workflows and dev-dependency pins as a recurring supply-chain surface, pin action SHAs, and review updates on a schedule.
- How do I update an existing package when nunomaduro/skeleton-php changes upstream?
- There is no automatic upgrade path. Once you fork or generate a package from the template, you own that copy and upstream changes will not reach it. Establish an owner and a cadence for manually reviewing upstream commits and security patches, then backport relevant changes to your internal template. Avoid retrofitting existing packages just to match the skeleton; apply it to new packages instead.
- What are alternatives to nunomaduro/skeleton-php?
- Alternatives include an internal scaffold, other community package skeletons, Laravel-specific skeletons with Testbench and service-provider stubs, or monorepo tooling if you create packages in one repository. The right choice depends on your CI provider, whether packages are Laravel-specific, and how much opinionation you want. Evaluate maintenance activity and how easily the template maps to your existing standards before adopting it.
- Does nunomaduro/skeleton-php work with GitLab CI, Bitbucket, or monorepos?
- It ships with GitHub Actions, so GitLab CI or Bitbucket Pipelines require porting the workflow. Monorepos also need adaptation, such as path repositories and package-splitting tooling, because the skeleton assumes a standalone package repository. It is a strong fit for Composer-based shops on GitHub with a static-analysis gate, and a weak fit for non-GitHub CI or monorepos without rework.