`make cs` fired 2321 errors across legacy code, so it could not act as a
gate. Set the ~20 error-level sniffs to severity 0 in a clearly-marked
TEMPORARY block (and ParameterTypeHint in its own block), and add
ignore_warnings_on_exit so advisory warnings (line length, cyclomatic
"too high", silenced errors) are still reported but do not fail the run.
`make cs` now exits 0.
These mutes are technical debt to unwind ONE sniff at a time (drop the
severity line, run make cs, fix, commit); no new violations should be
added under a muted rule. Muting ParameterTypeHint also stops cs-fix from
re-adding the null-crash param types (see TYPE_AUDIT.md). Biggest buckets:
ParameterTypeHint 1323, GlobalKeyword 452, camelCaps naming 231,
CyclomaticComplexity.MaxExceeded 174.
Reviewed the Generic.PHP.ForbiddenFunctions list against real usage: the
whole 20-function ban produced only two kinds of violations across src —
is_null (84) and extract (2); the other 18 entries have zero call sites
and stay as free guardrails.
- is_null: dropped from the ban. It is equivalent to `=== null` and the
prohibition was purely cosmetic; keeping it avoids churning 41 files
for no functional gain.
- extract: kept banned (it injects variables from array keys — a real
footgun), but the two legitimate uses in the view-render layer
(BaseAdminController, BasePlayerController) expose the payload to legacy
PHP templates and cannot be removed without rewriting every view, so
they are annotated with `// phpcs:ignore` and a rationale.
phpcs ForbiddenFunctions now reports 0 findings. 721 tests green.
Rework build/phpcs.xml.dist from strict PSR-12 to the project's actual
house style so 'make cs-fix' is idempotent against the codebase:
- K&R (one-true-brace) instead of Allman; enforce via
Generic.Classes.OpeningBraceSameLine +
Generic.Functions.OpeningFunctionBraceKernighanRitchie, and exclude the
PSR12/PEAR/Squiz messages that push the opening brace to a new line.
- Tab indentation instead of 4 spaces: DisallowSpaceIndent + ScopeIndent
(tabIndent), and disable the tab-incompatible alignment sniffs
(MultiLineCondition, FunctionCallSignature, ControlStructureSpacing) plus
ConcatenationSpacing newlines so phpcbf converges (0 FAILED TO FIX).
- Restrict to PHP only (extensions=php) so .js/.css are never touched.
- Drop Generic.Formatting.SpaceAfterNot and Generic.PHP.RequireStrictTypes
(the codebase does not use declare(strict_types)).
- Add SlevomatCodingStandard.TypeHints.ParameterTypeHint to catch
untyped parameters.
Update CONTRIBUTING.md to run 'make cs-fix' first and describe the style.
PHP-CS-Fixer's `no_unused_imports` is conservative — it treats a class name that
merely appears in a PHPDoc *description* as "used", so genuinely-dead imports
(e.g. `use ...Request;` next to a "Request IP" doc description) were never
flagged. Slevomat's UnusedUses is precise: it parses annotation *types*
(@param/@return/@var), so it keeps docblock-typed imports but removes truly
unused ones — matching what Intelephense (P1003) reports.
- Swap require-dev: friendsofphp/php-cs-fixer -> squizlabs/php_codesniffer +
slevomat/coding-standard (+ phpcodesniffer-composer-installer, allow-listed).
- New narrow ruleset build/phpcs.xml.dist (import/namespace hygiene only, NOT
full PSR-12): UnusedUses (searchAnnotations=true), UseFromSameNamespace,
UseDoesNotStartWithBackslash, AlphabeticallySortedUses, UseSpacing,
NamespaceSpacing. View templates stay excluded.
- Makefile: `make cs` -> phpcs, `make cs-fix` -> phpcbf (same target names).
- CI code-style job, CLAUDE.md, CONTRIBUTING.md, docs, .gitignore updated;
build/.php-cs-fixer.dist.php removed. Committed vendor stays production-only.
Divarion_D