PHP Tooling
Priority: P2 (MEDIUM)
Structure
project/
├── composer.json
├── phpstan.neon
└── .php-cs-fixer.php
Implementation Guidelines
- Composer: Always commit
composer.lock for applications. Use composer audit and composer install in CI (not update) for locked versions.
- Autoloading: Strictly enforce PSR-4 autoloading in
composer.json (e.g., "psr-4": {"App\\": "src/"} — ensure backslashes escaped). Run composer dump-autoload after changes.
- Static Analysis: Mandate PHPStan (Level 5+) or Psalm in CI. Install via
composer require --dev phpstan/phpstan. Create phpstan.neon with parameters: { paths: [src], level: 6 }. Run via vendor/bin/phpstan analyse.
- Linting: Automate PSR-12 standards via
composer require --dev friendsofphp/php-cs-fixer. Configure in .php-cs-fixer.php with $config->setRules(['@PSR12' => true]). Use php-cs-fixer to enforce standards.
- Execution: Use
PHP 8.1+ to leverage performance improvements (JIT, OpCache).
- Scripts: Define standard task
"scripts": { in composer.json ("analyze": "phpstan analyse", "test": "phpunit", "check": ["@fix", "@analyze", "@test"]}). Run with composer check.
- Debugging: Use
Xdebug for local development only. Remove xdebug.so from prod config or set XDEBUG_MODE=off in production.
- Docker: Use Multi-stage Dockerfiles with
php:8.x-fpm or php:8.x-cli base images.
Anti-Patterns
- No manual
require: Use Composer PSR-4 autoloading only.
- No blind composer updates: Review
composer.lock diff first.
- No Xdebug in production: Disable extension in prod env.
- No
vendor/ in git: Exclude via .gitignore; use Composer.
