PHP Tooling
Priority: P2 (MEDIUM)
Structure
project/
├── composer.json
├── phpstan.neon
└── .php-cs-fixer.php
Implementation Guidelines
- Composer: Always commit
composer.lockfor applications. Usecomposer auditandcomposer install in CI(notupdate) for locked versions. - Autoloading: Strictly enforce PSR-4 autoloading in
composer.json(e.g.,"psr-4": {"App\\": "src/"}— ensure backslashes are escaped). Runcomposer dump-autoloadafter changes. - Static Analysis: Mandate PHPStan (Level 5+) or Psalm in CI. Install via
composer require --dev phpstan/phpstan. Createphpstan.neonwithparameters: { paths: [src], level: 6 }. Run viavendor/bin/phpstan analyse. - Linting: Automate PSR-12 standards via
composer require --dev friendsofphp/php-cs-fixer. Configure in.php-cs-fixer.phpwith$config->setRules(['@PSR12' => true]). Usephp-cs-fixerto enforce standards. - Execution: Use
PHP 8.1+to leverage performance improvements (JIT, OpCache). - Scripts: Define standard task
"scripts": {incomposer.json("analyze": "phpstan analyse", "test": "phpunit", "check": ["@fix", "@analyze", "@test"]}). Run withcomposer check. - Debugging: Use
Xdebugfor local development only. Remove xdebug.so from prod config or set XDEBUG_MODE=off in production. - Docker: Use Multi-stage Dockerfiles with
php:8.x-fpmorphp:8.x-clibase images.
Anti-Patterns
- No manual
require: Use Composer PSR-4 autoloading only. - No blind composer updates: Review
composer.lockdiff first. - No Xdebug in production: Disable the extension in prod env.
- No
vendor/in git: Exclude via.gitignore; use Composer.