README

Collection of commonly used PHP QA tools.

Included in this package are:

• phpunit/phpunit The PHP Unit Testing framework.
• phpmd/phpmd PHPMD is a spin-off project of PHP Depend and aims to be a PHP equivalent of the well known Java tool PMD.
• squizlabs/php_codesniffer PHP_CodeSniffer tokenises PHP, JavaScript and CSS files and detects violations of a defined set of coding standards.
• doctrine/coding-standard The PHP_CodeSniffer ruleset the bundled BearSunday standard builds on.
• phpstan/phpstan A PHP Static Analysis Tool.
• vimeo/psalm A static analysis tool for PHP.
• phpmetrics/phpmetrics Static analysis tool for PHP.

Installation

Global install

composer global require bear/qatools

Local install

composer require --dev bear/qatools

QA Configs

PHP_CodeSniffer, PHPStan and PHPMD are configured by reference rather than by copying, so fixes to the shared rules reach your project with composer update.

The vendor/bear/qatools/ paths below assume the local install above. A global install puts the package outside your project, so adjust the paths to wherever composer global config home reports, or install locally. A globally registered PHP_CodeSniffer standard is also invisible to a project-local vendor/bin/phpcs, which is what editors usually pick up.

PHP_CodeSniffer — bear/qatools registers itself as a standard named BearSunday, so your phpcs.xml only needs to name it:

<ruleset>
    <config name="php_version" value="80200"/>

    <file>src</file>
    <file>tests</file>
    <exclude-pattern>*/tests/Fake/*</exclude-pattern>
    <exclude-pattern>*/tests/tmp/*</exclude-pattern>

    <rule ref="BearSunday"/>
</ruleset>

Registration happens through dealerdirect/phpcodesniffer-composer-installer, which Composer only runs if your project allows it:

composer config allow-plugins.dealerdirect/phpcodesniffer-composer-installer true

Without that, composer install fails with a blocked-plugin error, or — if the plugin is explicitly denied — installs quietly and leaves phpcs reporting Referenced sniff "BearSunday" does not exist. Standard names are global with no namespacing; phpcs -e --standard=BearSunday shows what the name resolved to.

PHPStan — include the shared settings and add your own paths:

includes:
    - vendor/bear/qatools/phpstan-base.neon

parameters:
    paths:
        - src
        - tests

PHPMD — point at the shipped ruleset directly, no local file needed:

phpmd src text vendor/bear/qatools/phpmd.xml

Ready-made versions of the first two are in the package root if you would rather start from a copy than write your own:

cp vendor/bear/qatools/phpcs.xml .
cp vendor/bear/qatools/phpstan.neon .

Psalm — copy-based; Psalm has no mechanism for including an external config:

cp vendor/bear/qatools/psalm.xml .

PHPUnit — copy-based; the template is project-local by nature:

cp vendor/bear/qatools/phpunit.xml.dist phpunit.xml

CI Configs

cp vendor/bear/qatools/.scrutinizer.yml .

• phpunit.xml
• phpcs.xml
• phpmd.xml
• .scrutinizer.yml

Usage

Composer Scripts

Composer does not inherit scripts from dependencies, so copy the scripts block from vendor/bear/qatools/composer.json into your own composer.json to get these:

composer tests      # Run cs, sa, and test in sequence
composer test       # Run PHPUnit tests
composer cs         # Run PHP_CodeSniffer
composer cs-fix     # Auto-fix coding standard violations with phpcbf
composer sa         # Run all static analysis (phpstan, psalm, phpmd)
composer coverage   # Generate test coverage report
composer metrics    # Generate PHPMetrics HTML report

Direct Commands

phpunit

phpunit

phpcs

phpcs --standard=./phpcs.xml src

phpstan

phpstan analyse -c phpstan.neon

psalm

psalm

phpmd

phpmd src text vendor/bear/qatools/phpmd.xml

phpmetrics

phpmetrics --report-html=build/metrics src

Code Standards

• PSR-12 base with Doctrine Coding Standard
• PHPStan level: max, over src and tests
• Psalm errorLevel: 1, over src only
• PHP compatibility: 8.2.27+, and 8.3.16+ on PHP 8.3

The 8.3 floor comes from Psalm 6, which requires ~8.2.27 || ~8.3.16 || ~8.4.3 || ~8.5.0; Composer refuses to install on PHP 8.3.0–8.3.15, including Ubuntu 24.04's stock 8.3.6.

Psalm is deliberately kept off tests: errorLevel 1 is too strict for test code, where rules such as ClassMustBeFinal work against normal PHPUnit practice. UnusedClass is suppressed as a consequence — with only src analysed, a class reached through the framework or used only from tests looks unused. Test code is still covered by phpcs and PHPStan.