Replace the `<severity>0</severity>` mute block with single-line toggles so
disabled sniffs can be re-enabled one at a time, per the technical-debt
ratchet. Two mechanisms, because phpcs `<exclude>` cannot be overridden by a
later ref:
- sniffs with their own `<rule ref>` are commented out in place (uncomment
to enable): CamelCapsFunctionName, MultiLineAssignment,
UnnecessaryStringConcat, SAPIUsage, AbstractClassNamePrefix,
InterfaceNameSuffix, TraitNameSuffix, DeprecatedFunctions, ClassFileName,
GlobalKeyword;
- sniffs pulled in by the PSR12 parent are `<exclude>`d inside it (delete the
exclude to enable): CamelCapsMethodName, FileHeader.IncorrectOrder,
MethodDeclaration.Underscore, SwitchDeclaration.TerminatingComment,
PSR1.Classes.ClassDeclaration, PropertyDeclaration.Underscore,
ValidClassName;
- CyclomaticComplexity/NestingLevel MaxExceeded are message-level excludes on
their own refs (TooHigh warning still reports).
ControlStructureSpacing and PEAR FunctionCallSignature (tab-incompatible) and
ParameterTypeHint (null-crash fixer footgun) are marked DO NOT ENABLE. Added a
ratchet legend documenting every toggle, its violation count, and a suggested
enable order. `make cs` stays green (0 errors) and `make cs-fix` converges;
both toggle directions verified.
`make cs-fix` reported FAILED TO FIX on 20+ files and exited non-zero.
Root cause: PSR12.ControlStructures.ControlStructureSpacing is a
space-alignment sniff (LineIndent expects "12 spaces" where the code has
3 tabs; FirstExpressionLine/CloseParenthesisLine force the expanded
layout). phpcbf inserts the spaces, Generic.WhiteSpace.DisallowSpaceIndent
strips them back, and the fixer never converges. It also contradicts the
project's K&R same-line multi-line-condition layout.
Retire that sniff (it cannot work as a fixer under tab indentation) and
enforce the same concern with its tab-compatible equivalent,
PEAR.ControlStructures.MultiLineCondition, which converges. Reformat the
22 affected files to the canonical PEAR layout (whitespace only —
token-identical to before). `make cs-fix` now converges and `make cs`
is green.
`make cs` fired 2321 errors across legacy code, so it could not act as a
gate. Set the ~20 error-level sniffs to severity 0 in a clearly-marked
TEMPORARY block (and ParameterTypeHint in its own block), and add
ignore_warnings_on_exit so advisory warnings (line length, cyclomatic
"too high", silenced errors) are still reported but do not fail the run.
`make cs` now exits 0.
These mutes are technical debt to unwind ONE sniff at a time (drop the
severity line, run make cs, fix, commit); no new violations should be
added under a muted rule. Muting ParameterTypeHint also stops cs-fix from
re-adding the null-crash param types (see TYPE_AUDIT.md). Biggest buckets:
ParameterTypeHint 1323, GlobalKeyword 452, camelCaps naming 231,
CyclomaticComplexity.MaxExceeded 174.
Reviewed the Generic.PHP.ForbiddenFunctions list against real usage: the
whole 20-function ban produced only two kinds of violations across src —
is_null (84) and extract (2); the other 18 entries have zero call sites
and stay as free guardrails.
- is_null: dropped from the ban. It is equivalent to `=== null` and the
prohibition was purely cosmetic; keeping it avoids churning 41 files
for no functional gain.
- extract: kept banned (it injects variables from array keys — a real
footgun), but the two legitimate uses in the view-render layer
(BaseAdminController, BasePlayerController) expose the payload to legacy
PHP templates and cannot be removed without rewriting every view, so
they are annotated with `// phpcs:ignore` and a rationale.
phpcs ForbiddenFunctions now reports 0 findings. 721 tests green.
Rework build/phpcs.xml.dist from strict PSR-12 to the project's actual
house style so 'make cs-fix' is idempotent against the codebase:
- K&R (one-true-brace) instead of Allman; enforce via
Generic.Classes.OpeningBraceSameLine +
Generic.Functions.OpeningFunctionBraceKernighanRitchie, and exclude the
PSR12/PEAR/Squiz messages that push the opening brace to a new line.
- Tab indentation instead of 4 spaces: DisallowSpaceIndent + ScopeIndent
(tabIndent), and disable the tab-incompatible alignment sniffs
(MultiLineCondition, FunctionCallSignature, ControlStructureSpacing) plus
ConcatenationSpacing newlines so phpcbf converges (0 FAILED TO FIX).
- Restrict to PHP only (extensions=php) so .js/.css are never touched.
- Drop Generic.Formatting.SpaceAfterNot and Generic.PHP.RequireStrictTypes
(the codebase does not use declare(strict_types)).
- Add SlevomatCodingStandard.TypeHints.ParameterTypeHint to catch
untyped parameters.
Update CONTRIBUTING.md to run 'make cs-fix' first and describe the style.
PHP-CS-Fixer's `no_unused_imports` is conservative — it treats a class name that
merely appears in a PHPDoc *description* as "used", so genuinely-dead imports
(e.g. `use ...Request;` next to a "Request IP" doc description) were never
flagged. Slevomat's UnusedUses is precise: it parses annotation *types*
(@param/@return/@var), so it keeps docblock-typed imports but removes truly
unused ones — matching what Intelephense (P1003) reports.
- Swap require-dev: friendsofphp/php-cs-fixer -> squizlabs/php_codesniffer +
slevomat/coding-standard (+ phpcodesniffer-composer-installer, allow-listed).
- New narrow ruleset build/phpcs.xml.dist (import/namespace hygiene only, NOT
full PSR-12): UnusedUses (searchAnnotations=true), UseFromSameNamespace,
UseDoesNotStartWithBackslash, AlphabeticallySortedUses, UseSpacing,
NamespaceSpacing. View templates stay excluded.
- Makefile: `make cs` -> phpcs, `make cs-fix` -> phpcbf (same target names).
- CI code-style job, CLAUDE.md, CONTRIBUTING.md, docs, .gitignore updated;
build/.php-cs-fixer.dist.php removed. Committed vendor stays production-only.
Divarion_D