Plugin Api Laravel Package

Product Decisions This Supports

• Custom Code Quality Enforcement: Enables Laravel teams to define project-specific static analysis rules (e.g., Laravel conventions like use App\Models\ prefixes, Blade template validation, or service container best practices) without relying on rigid third-party tools.
• Modular CI/CD Pipelines: Supports lightweight, reusable quality checks in CI (e.g., fail builds on custom violations) without bloating pipelines with monolithic tools like SonarQube.
• Build vs. Buy for Niche Needs:
  • Build: Justify custom plugins for proprietary standards (e.g., security policies, legacy code migration rules).
  • Buy: Leverage existing plugins (if available) for common use cases (e.g., PSR-12 compliance).
• Roadmap for Developer Experience:
  • Plugin Marketplace: Position Laravel as a hub for phpcq plugins (e.g., laravel/phpcq-plugin-blade, laravel/phpcq-plugin-auth).
  • IDE Integration: Extend plugins to work with PHPStorm/Laravel IDE Helper for real-time feedback.
• Use Cases:
  • Framework-Specific Rules: Enforce Laravel idioms (e.g., "avoid new App\Models\User in controllers").
  • Security Hardening: Add custom checks for SQL injection, XSS, or deprecated Laravel methods.
  • Legacy Migration: Gradually enforce modern Laravel patterns in older codebases.
  • Team Onboarding: Automate "Laravel way" checks for new developers.

When to Consider This Package

• Adopt When:
  • Your team needs beyond-PSR code quality rules (e.g., Laravel-specific, business-domain logic).
  • You’re using or evaluating phpcq as your primary PHP static analysis tool (vs. PHPStan/Psalm).
  • You prioritize modularity over monolithic tools (e.g., avoid SonarQube’s overhead).
  • Your CI/CD pipeline can handle lightweight plugins (not heavy static analysis).
  • You want to contribute back to the PHP ecosystem (MIT license, early-stage project).
• Look Elsewhere If:
  • You need out-of-the-box Laravel support (e.g., Blade linting, Eloquent validation—consider beberlei/assert or spatie/laravel-phpstan-rules).
  • Your team lacks PHP plugin development expertise (high learning curve for custom rules).
  • You require enterprise features (e.g., SAST, deep static analysis—use SonarQube or Snyk).
  • The phpcq ecosystem is too immature (0 stars, 0 dependents; validate via community adoption).

How to Pitch It (Stakeholders)

For Executives: "This package lets us tailor PHP code quality to Laravel’s needs without vendor lock-in. By building custom plugins (e.g., for Blade security or service container rules), we can automate compliance, reduce bugs, and improve onboarding—all while keeping our tooling lightweight and open-source. It’s a strategic investment in developer productivity and code reliability."

For Engineering (Laravel Teams): *"The phpcq/plugin-api lets us extend Laravel’s static analysis with custom logic. For example:

• PMs: Enforce ‘no new in controllers’ or ‘use Fractal for APIs’.
• Backend Devs: Add checks for deprecated Laravel methods or N+1 queries.
• DevOps: Plug into CI/CD for faster, targeted feedback. It’s MIT-licensed, integrates with Laravel’s CLI, and avoids the bloat of tools like SonarQube. We can start small (1–2 custom rules) and scale as needed."*

Key Asks:

1. Validation: Confirm phpcq aligns with our tooling (vs. PHPStan/Psalm).
2. Resource Commitment: Allocate time for plugin development (or prioritize community plugins).
3. ROI: Pilot with high-impact rules (e.g., security headers in routes, Blade escaping).

For Open-Source Contributors: "This is a chance to shape the future of Laravel code quality. By contributing plugins (e.g., laravel/phpcq-plugin-auth), we can make phpcq the go-to tool for Laravel teams—just like laravel/pint for formatting."