| name | php-tooling |
| description | Configure PHP ecosystem tooling, dependency management, and static analysis. Use when managing Composer dependencies, running PHPStan, or configuring PHP build tools. |
| metadata | {"triggers":{"files":["composer.json"],"keywords":["composer","lock","phpstan","xdebug"]}} |
PHP Tooling
Priority: P2 (MEDIUM)
Structure
project/
├── composer.json
├── phpstan.neon
└── .php-cs-fixer.php
Implementation Guidelines
- Composer: Always commit
composer.lock for applications. Use composer audit and composer install in CI (not update) for locked versions.
- Autoloading: Strictly enforce PSR-4 autoloading in
composer.json (e.g., "psr-4": {"App\\": "src/"} — ensure backslashes escaped). Run composer dump-autoload after changes.
- Static Analysis: Mandate PHPStan (Level 5+) or Psalm in CI. Install via
composer require --dev phpstan/phpstan. Create phpstan.neon with parameters: { paths: [src], level: 6 }. Run via vendor/bin/phpstan analyse.
- Linting: Automate PSR-12 standards via
composer require --dev friendsofphp/php-cs-fixer. Configure in .php-cs-fixer.php with $config->setRules(['@PSR12' => true]). Use php-cs-fixer to enforce standards.
- Execution: Use
PHP 8.1+ to leverage performance improvements (JIT, OpCache).
- Scripts: Define standard task
"scripts": { in composer.json ("analyze": "phpstan analyse", "test": "phpunit", "check": ["@fix", "@analyze", "@test"]}). Run with composer check.
- Debugging: Use
Xdebug for local development only. Remove xdebug.so from prod config or set XDEBUG_MODE=off in production.
- Docker: Use Multi-stage Dockerfiles with
php:8.x-fpm or php:8.x-cli base images.
Anti-Patterns
- No manual
require: Use Composer PSR-4 autoloading only.
- No blind composer updates: Review
composer.lock diff first.
- No Xdebug in production: Disable extension in prod env.
- No
vendor/ in git: Exclude via .gitignore; use Composer.
Canonical response anchors
When this skill applies, preserve the following domain terminology or equivalent concrete examples in the answer when relevant:
- Always commit composer,always
- Remove xdebug.so
- composer check
- composer install in CI
- paths: [src]
- set XDEBUG_MODE=off
