Linters & Formatters

Pin PHP CS Fixer and a versioned set such as @PER-CS3x0, keep risky rules out, preview with check --diff, apply fix in a commit that contains nothing else, list that commit in .git-blame-ignore-revs, and start enforcing with check.

A risky PHP CS Fixer rule is one whose rewrite can change how the code behaves, such as strict_param or declare_strict_types; they run only when the config calls setRiskyAllowed(true) or the command passes --allow-risky=yes.

PHP CS Fixer suits teams that want every rule fixed automatically, including modernising and risky rewrites; PHP_CodeSniffer suits teams that must also report conventions no tool can fix. Running both works when only one of them owns layout.

Declare @template T above the class, use T in @param and @return tags, declare @implements IteratorAggregate<int, T> for foreach, and type usages as Collection<User>; PHPStan then infers User from get() and foreach and rejects adding other types.

Bleeding Edge, enabled by including phar://phpstan.phar/conf/bleedingEdge.neon, turns on the next major version's rules and behaviour early; phpstan-strict-rules is an opinionated extension of extra checks, enabled through phpstan/extension-installer or by including its rules.neon.

Start at level 0 over your own code only, fix configuration noise such as unknown classes with scanDirectories, bootstrapFiles and framework extensions, get to zero, gate CI there, then raise one level at a time, expecting level 6 to be the big jump.

rubocop -A applied corrections marked unsafe: the frozen-string-literal comment froze mutated literals (FrozenError), and x && x.foo became x&.foo, which breaks when x is false. Run -a first, then -A one cop at a time with tests between.

--auto-gen-config writes .rubocop_todo.yml, which excludes each offending file per cop (up to 15, then disables the cop) or raises Metrics Max values, and links it via inherit_from. Delete entries as you fix code; --report-unused-todo-entries fails on stale ones.

Pending cops are new cops that stay off until you decide; set each one's Enabled, or NewCops for all or per department. The require: warning means the gem is now a plugin, so list it under plugins: instead.

List lint_roller plugin gems such as standard-rails under plugins:, or RuboCop YAML files under extend_config:. Configuration is first-in-wins: Standard's built-in plugins load first, so later plugins and files can add cops but never reconfigure ones already set.

Enforce what prevents bugs first: Lint and Security fail the build; Layout is autocorrected once; Style and Metrics are chosen deliberately. Encode it with department and cop Enabled, Severity, AllCops FailLevel and, for a strict opt-in list, DisabledByDefault.

Because autoCorrect only reaches rules that implement a correction. Most detekt rules describe a design problem with no mechanical fix — a long method or a magic number cannot be rewritten automatically — so they stay reported no matter how the flag is set.

Each rubocop invocation spends much of its time loading RuboCop and its plugins. --server keeps a background process with everything loaded and forwards later commands to it; --lsp runs a long-lived language server that editors talk to directly.

Upgrading to PHP_CodeSniffer 4.0 changes exit codes, the default standard (PEAR to PSR12) and output streams, removes the @codingStandardsIgnore annotations, some sniffs and the string array-property syntax, and renames several error codes, so check scripts, suppressions and the ruleset.

PHP CS Fixer skips files whose content hash matches .php-cs-fixer.cache and reruns everything when the rules or tool version change, and since 3.94 it spreads files across worker processes by default; stale caches and constrained CI machines are the usual sources of trouble.

Put standard in the Gemfile's development group, set ruby_version: 3.2 in .standard.yml, and make rake's default task run tests and standard. Choose plain RuboCop to tune cops, enforce Metrics, or use features newer than Standard's pinned RuboCop.