Run any Skill in Manus with one click

drupal-coding-standards

Stars2

Forks0

UpdatedJuly 6, 2026 at 17:43

The shared modern coding + documentation standards for custom Drupal 10/11 code; Drupal 10.3+ idioms (constructor property promotion, PHP attributes not annotations, #config_target, OOP #[Hook] implementations, translatable strings, dependency injection), Doxygen doc-blocks and .api.php, README/documentation-file conventions, and secrets handling. Use when writing, editing, or reviewing any custom Drupal module/theme/profile code. The other drupal-* skills (module-scaffold, hook-update-n, phpunit-tests) follow this baseline; cite it rather than duplicating these rules.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

ucsb

ucsb/drupal-site-test-suite

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Software DevelopersComputer and Mathematical Occupations·SOC 15-1252

File Explorer

4 files

SKILL.md

readonly

name	drupal-coding-standards
description	The shared modern coding + documentation standards for custom Drupal 10/11 code; Drupal 10.3+ idioms (constructor property promotion, PHP attributes not annotations, #config_target, OOP #[Hook] implementations, translatable strings, dependency injection), Doxygen doc-blocks and .api.php, README/documentation-file conventions, and secrets handling. Use when writing, editing, or reviewing any custom Drupal module/theme/profile code. The other drupal-* skills (module-scaffold, hook-update-n, phpunit-tests) follow this baseline; cite it rather than duplicating these rules.
metadata	{"version":"2026.07.06"}

Drupal Coding Standards

The shared baseline for custom Drupal 10/11 code, the modern idioms and documentation conventions every drupal-* skill and hand-written change should follow. Vendor-neutral: it targets any Drupal 10/11 site.

Much of this is enforced automatically by PHPCS (Drupal + DrupalPractice) and the drupal-code-quality-* skills; this doc is the authoring reference for what those checks expect plus the conventions tools don't catch.

Prerequisites

Custom code under web/modules/custom/, web/themes/custom/, or web/profiles/custom/ (never edit core/contrib).
drupal/coder installed for PHPCS to apply the Drupal standard.

When To Use

Writing or editing any custom Drupal module/theme/profile code.
Reviewing custom code for standards compliance.
As the cited baseline from drupal-module-scaffold, drupal-hook-update-n, drupal-phpunit-tests, and the remediation skills.

The standards

Modern PHP/Drupal idioms (target Drupal 10.3+, DI, attributes, #config_target, OOP #[Hook], translatable strings, namespacing, naming conventions, and cacheability) → information/code-standards.md
Documentation & comments (Doxygen doc-blocks, .api.php, comment density, hook_help(), README/doc-file conventions) → information/documentation.md

Verifying compliance (this skill authors; other skills run the checks)

This skill defines how to write the code; it does not run any checks itself. To verify code meets these standards, use the QA skills and the test suite:

Code quality / static analysis: drupal-code-quality-audit → drupal-code-quality-remediation (or drush utest:lint); PHPCS Drupal+DrupalPractice, PHPStan, deprecations, and more.
Accessibility of rendered output (WCAG): drupal-accessibility-audit → drupal-accessibility-remediation (or the per-lane a11y commands: drush utest:alfa, utest:axe, utest:pa11y, utest:reflow, utest:meta-viewport). For accessible markup patterns, follow the a11y agent.
Behavior (works + stays working): write Unit/Kernel tests with drupal-phpunit-tests; run them via the suite (/tests/phpunit/run.js / drush utest:phpunit).

Author to this standard; verify with those.

Secrets: never in code

Never hard-code or commit secrets (API keys, tokens, passwords). Read them at runtime via the Key module (key.repository, injected through DI), the environment, or config; never a literal in PHP/YAML/JS. The drupal-code-quality-* suite detects committed secrets (gitleaks) and treats them as critical/security (remove and rotate). Provisioning secrets is hosting-specific (e.g. Pantheon Secrets); see the drupal-secrets-management skill.

Development

Maintenance guidance (keeping the standards current with Drupal releases, vendor-neutrality) → development/development-instructions.md

More from this repository

same repository

drupal-accessibility-audit

ucsb/drupal-site-test-suite

Evaluate and summarize accessibility (WCAG) findings on a Drupal 10 or 11 site; aggregating the a11y test lanes (axe-core, Siteimprove Alfa, pa11y, reflow at 320px, meta-viewport). Read-only: it gets findings (from `drush utest:alfa|axe|pa11y|reflow|meta-viewport` runs or existing JSON/HTML reports), normalizes and merges them, classifies each as legally-required (standard profile) vs aspirational (comprehensive AAA/best-practice), attributes it to custom code vs upstream core/contrib, and produces a prioritized, profile-aware accessibility audit. Use for "audit accessibility", "what WCAG issues does the site have", "summarize the axe/pa11y/Alfa report", "check accessibility compliance". Stops before changing files; hand off to drupal-accessibility-remediation to fix. Never claims full conformance.

2026-07-062

drupal-accessibility-remediation

ucsb/drupal-site-test-suite

Apply fixes for accessibility (WCAG) findings on the CUSTOM code of a Drupal 10 or 11 site, then re-verify. Consumes the audit from drupal-accessibility-audit, maps each page/selector finding back to the custom Twig template / theme CSS / content / config that produced it, proposes WCAG-correct fixes (reusing the a11y agent's WCAG 2.2 AA knowledge), dry-runs them, and applies only confirmed changes; prioritizing legally-required (WCAG A/AA) issues. Most a11y fixes need human judgment (alt text, ARIA, contrast) so it confirms before writing. Writes only to the working tree; never commits, never pushes. Never claims full conformance; human testing still required. Use for "fix the accessibility issues", "remediate the WCAG/axe/pa11y violations", "fix the a11y findings".

2026-07-062

drupal-code-quality-audit

ucsb/drupal-site-test-suite

Evaluate and summarize code-quality / static-analysis findings on the CUSTOM code of a Drupal 10 or 11 site; PHPCS, PHPStan, ESLint, cspell, composer audit/validate, markdownlint, actionlint, deprecations, and related engines. Read-only: it gets findings (from a `drush utest:lint` run, an existing JSON/HTML report, or by evaluating custom code directly when no test suite exists), normalizes them, then groups, dedups, and prioritizes into an audit/triage report. Use for "audit the lint results", "what coding-standards issues does my custom module have", "summarize the static-analysis report", "evaluate my site's custom code for quality issues", "triage the findings". Stops before changing files; hand off to drupal-code-quality-remediation to fix.

2026-07-062

drupal-code-quality-remediation

ucsb/drupal-site-test-suite

Apply safe fixes to code-quality / linting findings on the CUSTOM code of a Drupal 10 or 11 site, then re-verify. Consumes the audit from drupal-code-quality-audit (its diagnostic agent), dry-runs the fixes, gets confirmation, and auto-applies ONLY high-confidence mechanical fixes (phpcbf, eslint --fix, stylelint --fix, markdownlint --fix, editorconfig); flagging everything else (PHPStan type errors, logic, security, deprecations) for human review. Use for "fix the lint errors", "apply the safe coding-standards fixes", "clean up the linting violations", "remediate the static-analysis report". Writes only to the working tree; it never commits and never pushes.

2026-07-062

drupal-config-management

ucsb/drupal-site-test-suite

Manage Drupal 10/11 configuration across environments, the config sync workflow (drush config:export / config:import), module config (config/install vs config/sync, required schema), environment-specific config via config_split, and site-specific overrides via config_ignore. Detects whether a site actually uses config management before applying. Use when exporting/importing config, setting up per-environment config, or diagnosing config drift. Vendor-neutral; follows drupal-coding-standards.

2026-07-062

drupal-hook-update-n

ucsb/drupal-site-test-suite

Write Drupal `hook_update_N` / `hook_post_update_NAME` functions for custom modules; config rewrites, module/theme machine-name renames, entity-bundle and field-storage changes, permission remaps, data backfills; plus the paired update-path test fixture. Use when an upstream/shared codebase ships a schema/config/data change that downstream sites must apply on update (mutating state that already exists on a running site). Vendor-neutral; follows drupal-coding-standards.

2026-07-062

name	drupal-coding-standards
description	The shared modern coding + documentation standards for custom Drupal 10/11 code; Drupal 10.3+ idioms (constructor property promotion, PHP attributes not annotations, #config_target, OOP #[Hook] implementations, translatable strings, dependency injection), Doxygen doc-blocks and .api.php, README/documentation-file conventions, and secrets handling. Use when writing, editing, or reviewing any custom Drupal module/theme/profile code. The other drupal-* skills (module-scaffold, hook-update-n, phpunit-tests) follow this baseline; cite it rather than duplicating these rules.
metadata	{"version":"2026.07.06"}

Drupal Coding Standards

Prerequisites

Custom code under web/modules/custom/, web/themes/custom/, or web/profiles/custom/ (never edit core/contrib).
drupal/coder installed for PHPCS to apply the Drupal standard.

When To Use

Writing or editing any custom Drupal module/theme/profile code.
Reviewing custom code for standards compliance.
As the cited baseline from drupal-module-scaffold, drupal-hook-update-n, drupal-phpunit-tests, and the remediation skills.

The standards

Modern PHP/Drupal idioms (target Drupal 10.3+, DI, attributes, #config_target, OOP #[Hook], translatable strings, namespacing, naming conventions, and cacheability) → information/code-standards.md
Documentation & comments (Doxygen doc-blocks, .api.php, comment density, hook_help(), README/doc-file conventions) → information/documentation.md

Verifying compliance (this skill authors; other skills run the checks)

This skill defines how to write the code; it does not run any checks itself. To verify code meets these standards, use the QA skills and the test suite:

Code quality / static analysis: drupal-code-quality-audit → drupal-code-quality-remediation (or drush utest:lint); PHPCS Drupal+DrupalPractice, PHPStan, deprecations, and more.
Accessibility of rendered output (WCAG): drupal-accessibility-audit → drupal-accessibility-remediation (or the per-lane a11y commands: drush utest:alfa, utest:axe, utest:pa11y, utest:reflow, utest:meta-viewport). For accessible markup patterns, follow the a11y agent.
Behavior (works + stays working): write Unit/Kernel tests with drupal-phpunit-tests; run them via the suite (/tests/phpunit/run.js / drush utest:phpunit).

Author to this standard; verify with those.

Secrets: never in code

Development

Maintenance guidance (keeping the standards current with Drupal releases, vendor-neutrality) → development/development-instructions.md