phpcs.xml

<?xml version="1.0"?>
<ruleset xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="PHP_CodeSniffer" xsi:noNamespaceSchemaLocation="phpcs.xsd">
    <description>Coding standard for Decidesk, based on the Conduction/OpenRegister standard.</description>

    <file>lib</file>

    <!-- Exclude external and vendor files -->
    <exclude-pattern>*/vendor/*</exclude-pattern>
    <exclude-pattern>*/vendor-bin/*</exclude-pattern>
    <exclude-pattern>*/node_modules/*</exclude-pattern>
    <exclude-pattern>composer-setup.php</exclude-pattern>
    <!-- Apps that ship a verbatim template snapshot under lib/Resources/template/ (e.g. openbuild)
         keep it out of lint scope; no-op for apps without the directory. -->
    <exclude-pattern>lib/Resources/template/*</exclude-pattern>

    <!-- Surface phpcs warnings (e.g. SpecTagSniff) in CI logs without failing the build. -->
    <config name="ignore_warnings_on_exit" value="1"/>

    <arg name="basepath" value="."/>
    <arg name="colors"/>
    <arg name="parallel" value="75"/>
    <arg name="extensions" value="php"/>
    <arg value="p"/>

    <!-- Don't hide tokenizer exceptions -->
    <rule ref="Internal.Tokenizer.Exception">
        <type>error</type>
    </rule>

    <!-- Include the whole PEAR standard -->
    <rule ref="PEAR">
        <exclude name="PEAR.NamingConventions.ValidFunctionName"/>
        <exclude name="PEAR.NamingConventions.ValidVariableName"/>
        <exclude name="PEAR.Commenting.ClassComment"/>
        <exclude name="PEAR.Commenting.FileComment.MissingCategoryTag"/>
        <exclude name="PEAR.Commenting.FileComment.MissingPackageTag"/>
        <exclude name="PEAR.Commenting.FileComment.MissingLinkTag"/>
        <exclude name="PEAR.Commenting.FileComment.MissingVersion"/>
        <exclude name="PEAR.Commenting.InlineComment"/>
        <!-- Exclude indentation rules we'll configure separately -->
        <exclude name="PEAR.WhiteSpace.ScopeIndent"/>
    </rule>

    <!-- Include some sniffs from other standards that don't conflict with PEAR -->
    <rule ref="Squiz.Arrays.ArrayBracketSpacing"/>
    <rule ref="Squiz.ControlStructures.ControlSignature"/>
    <rule ref="Squiz.ControlStructures.ElseIfDeclaration"/>
    <rule ref="Squiz.Commenting.ClosingDeclarationComment"/>
    <rule ref="Squiz.Commenting.BlockComment"/>
    <rule ref="Squiz.Commenting.DocCommentAlignment"/>
    <rule ref="Squiz.Commenting.EmptyCatchComment"/>
    <rule ref="Squiz.Commenting.InlineComment"/>
    <!--
        InvalidEndChar demands that every inline comment end in `.`, `!` or `?`.
        Every one of the 97 occurrences in lib/ is the REUSE-mandated SPDX header

            // SPDX-License-Identifier: EUPL-1.2

        whose value is a machine-parsed SPDX expression: a trailing full stop
        would make it a different, invalid identifier and break REUSE
        compliance. The two requirements are in direct conflict and REUSE wins.

        This is recorded as a WARNING rather than silently inherited, because the
        state it preserves used to be accidental. Under php_codesniffer 3.13.5
        these same 97 findings were reported as warnings, so `composer phpcs`
        exited 1 and the gate passed. 3.13.6 — which this branch adopts to clear
        CVE-2026-67434 — reclassifies them as errors, so the same unchanged code
        exits 2 and the gate fails. Nothing about the code changed; only the
        tool's severity mapping did. Declaring the severity here makes the
        posture explicit and version-independent.

        Scope is deliberately narrow: only InvalidEndChar is downgraded. Every
        other Squiz.Commenting.InlineComment sniff (WrongStyle, NotCapital,
        SpacingBefore, Empty, …) still fails the build as an error.
    -->
    <rule ref="Squiz.Commenting.InlineComment.InvalidEndChar">
        <type>warning</type>
    </rule>
    <rule ref="Squiz.Commenting.LongConditionClosingComment"/>
    <rule ref="Squiz.Commenting.PostStatementComment"/>
    <rule ref="Squiz.Commenting.VariableComment"/>
    <rule ref="Squiz.Functions.FunctionDeclarationArgumentSpacing"/>
    <rule ref="Squiz.Operators.ComparisonOperatorUsage"/>
    <rule ref="Squiz.PHP.DisallowInlineIf"/>
    <rule ref="Squiz.Scope.MethodScope"/>
    <rule ref="Squiz.Strings.ConcatenationSpacing">
        <properties>
            <property name="ignoreNewlines" value="true"/>
        </properties>
    </rule>
    <rule ref="Squiz.WhiteSpace.ControlStructureSpacing"/>
    <rule ref="Squiz.WhiteSpace.FunctionSpacing">
        <properties>
            <property name="spacing" value="1"/>
            <property name="spacingAfterLast" value="0"/>
            <property name="spacingBeforeFirst" value="0"/>
        </properties>
    </rule>
    <rule ref="Squiz.WhiteSpace.MemberVarSpacing"/>
    <rule ref="Squiz.WhiteSpace.OperatorSpacing"/>
    <rule ref="Squiz.WhiteSpace.SuperfluousWhitespace"/>
    <rule ref="Generic.Arrays.DisallowLongArraySyntax"/>
    <rule ref="Generic.Commenting.Todo">
        <exclude name="Generic.Commenting.Todo"/>
    </rule>
    <rule ref="Generic.ControlStructures.DisallowYodaConditions"/>
    <rule ref="Generic.ControlStructures.InlineControlStructure"/>
    <rule ref="Generic.Formatting.DisallowMultipleStatements"/>
    <rule ref="Generic.Formatting.SpaceAfterCast"/>
    <rule ref="Generic.Files.LineLength">
        <properties>
            <property name="lineLimit" value="150"/>
            <property name="absoluteLineLimit" value="150"/>
        </properties>
    </rule>
    <rule ref="Generic.NamingConventions.ConstructorName"/>
    <rule ref="Generic.PHP.DeprecatedFunctions"/>
    <rule ref="Generic.PHP.LowerCaseKeyword"/>
    <rule ref="Generic.Strings.UnnecessaryStringConcat">
        <properties>
            <property name="allowMultiline" value="true"/>
        </properties>
    </rule>
    <rule ref="Generic.WhiteSpace.IncrementDecrementSpacing"/>
    <rule ref="PSR2.Classes.PropertyDeclaration"/>
    <rule ref="PSR2.Methods.MethodDeclaration"/>
    <rule ref="PSR2.Files.EndFileNewline"/>
    <rule ref="PSR12.Files.OpenTag"/>
    <rule ref="Zend.Files.ClosingTag"/>

    <!-- PEAR uses warnings for inline control structures, so switch back to errors -->
    <rule ref="Generic.ControlStructures.InlineControlStructure">
        <properties>
            <property name="error" value="true"/>
        </properties>
    </rule>

    <!-- We use custom indent rules for arrays -->
    <rule ref="Generic.Arrays.ArrayIndent"/>

    <!-- Selectively include array rules, excluding alignment rules -->
    <rule ref="Squiz.Arrays.ArrayDeclaration">
        <exclude name="Squiz.Arrays.ArrayDeclaration.KeyNotAligned"/>
        <exclude name="Squiz.Arrays.ArrayDeclaration.ValueNotAligned"/>
        <exclude name="Squiz.Arrays.ArrayDeclaration.CloseBraceNotAligned"/>
        <exclude name="Squiz.Arrays.ArrayDeclaration.CloseBraceNewLine"/>
        <exclude name="Squiz.Arrays.ArrayDeclaration.MultiLineNotAllowed"/>
        <exclude name="Squiz.Arrays.ArrayDeclaration.SingleLineNotAllowed"/>
    </rule>

    <!-- Check var names, but we don't want leading underscores for private vars -->
    <rule ref="Squiz.NamingConventions.ValidVariableName"/>
    <rule ref="Squiz.NamingConventions.ValidVariableName.PrivateNoUnderscore">
        <severity>0</severity>
    </rule>

    <!-- Only one argument per line in multi-line function calls -->
    <rule ref="PEAR.Functions.FunctionCallSignature">
        <properties>
            <property name="allowMultipleArguments" value="false"/>
            <property name="indent" value="8"/>
            <property name="requiredSpacesAfterOpen" value="0"/>
            <property name="requiredSpacesBeforeClose" value="0"/>
        </properties>
    </rule>

    <!-- Disable the indentation rule for multiline function declarations -->
    <rule ref="PEAR.Functions.FunctionCallSignature.Indent">
        <severity>0</severity>
    </rule>

    <!-- Disable the opening placement for multiline arrays -->
    <rule ref="PEAR.Functions.FunctionCallSignature.OpeningIndent">
        <severity>0</severity>
    </rule>

    <!-- Set standard indentation but don't apply it to function parameters -->
    <rule ref="Generic.WhiteSpace.ScopeIndent">
        <properties>
            <property name="indent" value="4"/>
            <property name="tabIndent" value="false"/>
            <property name="ignoreIndentationTokens" type="array">
                <element value="T_FUNCTION"/>
                <element value="T_CLOSURE"/>
                <element value="T_USE"/>
                <element value="T_PRIVATE"/>
                <element value="T_PROTECTED"/>
                <element value="T_PUBLIC"/>
                <element value="T_READONLY"/>
                <element value="T_ARRAY"/>
                <element value="T_OPEN_SHORT_ARRAY"/>
            </property>
        </properties>
    </rule>

    <!-- Have 12 chars padding maximum and always show as errors -->
    <rule ref="Generic.Formatting.MultipleStatementAlignment">
        <properties>
            <property name="maxPadding" value="12"/>
            <property name="error" value="true"/>
        </properties>
    </rule>

    <!-- Ban some functions -->
    <rule ref="Generic.PHP.ForbiddenFunctions">
        <properties>
            <property name="forbiddenFunctions" type="array">
                <element key="sizeof" value="count"/>
                <element key="delete" value="unset"/>
                <element key="print" value="echo"/>
                <element key="is_null" value="null"/>
                <element key="create_function" value="null"/>
                <element key="var_dump" value="null"/>
                <element key="die" value="null"/>
                <element key="error_log" value="null"/>
            </property>
        </properties>
    </rule>

    <!-- Private methods MUST not be prefixed with an underscore -->
    <rule ref="PSR2.Methods.MethodDeclaration.Underscore">
        <type>error</type>
    </rule>

    <!-- Private properties MUST not be prefixed with an underscore -->
    <rule ref="PSR2.Classes.PropertyDeclaration.Underscore">
        <type>error</type>
    </rule>

    <!-- Explicitly exclude other rules that might conflict -->
    <rule ref="Squiz.Functions.MultiLineFunctionDeclaration.SpaceAfterFunction">
        <severity>0</severity>
    </rule>
    <rule ref="Squiz.Functions.MultiLineFunctionDeclaration.FirstParamSpacing">
        <severity>0</severity>
    </rule>
    <rule ref="Squiz.Functions.MultiLineFunctionDeclaration.Indent">
        <severity>0</severity>
    </rule>
    <rule ref="PEAR.WhiteSpace.ScopeIndent.Incorrect">
        <severity>0</severity>
    </rule>

    <!-- Custom rule to enforce named parameters -->
    <rule ref="./phpcs-custom-sniffs/CustomSniffs/Sniffs/Functions/NamedParametersSniff.php">
        <type>error</type>
    </rule>

    <!-- Block calls to \OC::$server->getX() / \OC::$server->query() removed in Nextcloud 34. -->
    <rule ref="./phpcs-custom-sniffs/CustomSniffs/Sniffs/Nextcloud/NoLegacyServerAccessorsSniff.php">
        <type>error</type>
    </rule>

    <!-- Warn when a class or public method is missing the @spec PHPDoc tag (hydra ADR-003).
         Emitted as warnings (not errors) so CI surfaces the gap but doesn't block merges. -->
    <rule ref="./phpcs-custom-sniffs/CustomSniffs/Sniffs/Commenting/SpecTagSniff.php">
        <type>warning</type>
    </rule>

</ruleset>