- What does stolt/lean-package-validator do and why use it in a Laravel package?
- stolt/lean-package-validator, or lpv, checks that a PHP project or micro-package ships a lean dist archive, meaning common repository artifacts like tests, IDE configs, and CI files are excluded from release assets. It enforces this through .gitattributes export-ignore entries, so validation runs against a native Git feature rather than a custom format. For Laravel package authors it is a quick way to catch dev-only files that would otherwise end up in a Composer dist download.
- How do I install lean-package-validator in a Laravel project?
- Install it globally with composer global require stolt/lean-package-validator so the lean-package-validator binary lands on your PATH. For project-specific use, add it as a dev dependency with composer require --dev stolt/lean-package-validator and call the binary from your Composer scripts. It has no Laravel-specific dependencies, so it drops into any application or package without touching runtime code.
- Which PHP and Laravel versions does lean-package-validator support?
- The current release line requires PHP 8.2 or newer and is advertised as Laravel 13 ready. The tool itself is framework-agnostic, so it works with any Laravel version running on a supported PHP runtime. If your project is pinned to an older PHP floor, choose a matching lpv release or stay on the v5.x line.
- How do I run lpv validation in GitHub Actions or GitLab CI?
- Add a step such as composer validate-gitattributes or vendor/bin/lean-package-validator validate to your GitHub Actions, GitLab CI, or Forge deployment pipeline. Running it on pull requests and on the main branch catches export-ignore regressions before a release is tagged. If pipeline time matters, limit the archive-based check to critical branches.
- What breaking changes exist between v5.8.6 and v6.3.2, and should I upgrade?
- The baseline was validated on v5.8.6 while the current release is v6.3.2, and a major bump implies possible breaking changes to the PHP floor, CLI flags, or the .lpv schema, even though the published notes only describe a preset expansion. Read the v6 changelog and run validate --diff against a branch before merging the upgrade. Staying on v5.x and hand-porting selected patterns into a local .lpv file is a reasonable stopgap.
- Can I run lean-package-validator as a git hook or Composer script?
- Yes. You can wire lpv into a pre-commit or pre-push hook, or call it from the scripts section of composer.json so validation runs as part of your normal build commands. Many teams expose it as a composer validate-gitattributes script and reuse that same command in local hooks and CI, keeping both in sync.
- How do I create or update .gitattributes export-ignore entries with lpv?
- The create command scaffolds export-ignore entries in your .gitattributes, update adds or refreshes them, and reformat normalizes existing entries. All three operate on the same leanness rules that validate checks, so generating and verifying stay consistent. Commit the resulting .gitattributes so release behavior is reproducible for everyone on the team.
- How do I add Laravel-specific paths like vendor/ or storage/ to the validation?
- Use a custom .lpv file to define project-specific patterns, because the built-in PHP preset keeps expanding but does not know about Laravel paths such as vendor/, bootstrap/cache/, or storage/framework/views. Add whatever your project generates or excludes to your own preset and reference it when running the validator. This keeps Laravel-specific rules under your control while you still benefit from upstream preset improvements.
- Why are files newly flagged after upgrading to v6.3.2 and how do I avoid false positives?
- The v6.3.2 PHP preset is stricter, so files that previously passed may now be flagged or newly export-ignored, turning a green pipeline red after the upgrade. Run the validator with --diff against a branch to see exactly which patterns changed before merging. If a new match is wrong for your project, override it in a custom .lpv file instead of disabling the preset entirely.
- Does --validate-git-archive slow down CI pipelines for large repositories?
- The --validate-git-archive option builds temporary archives, which adds overhead proportional to repository size, so reserve it for main-branch builds or release jobs. For everyday pull requests, the plain validate command against .gitattributes is much cheaper and still catches missing export-ignore entries. This split keeps feedback fast while protecting the releases that matter.