plugins/php-expert/skills/php-quality-tooling/SKILL.md
Use when setting up or tuning static analysis, automated refactoring, and code-style enforcement on a framework-agnostic PHP project. Covers PHPStan, Rector, PHP-CS-Fixer, composer scripts, and CI wiring. Do NOT use for Laravel projects (Pint + Larastan → laravel-expert), test frameworks (→ php-testing), or language syntax questions (→ php-language-modern).
npx skillsauth add fusengine/agents php-quality-toolingInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Three complementary tools. PHPStan finds type bugs, Rector rewrites code (upgrades + refactors), PHP-CS-Fixer formats to a coding standard. They do not overlap — run all three.
Before ANY implementation, use TeamCreate to spawn 3 agents:
After implementation, run fuse-ai-pilot:sniper for validation.
| Tool | Role | Config file | Verdict |
|------|------|-------------|---------|
| PHPStan | Static analysis (type safety, dead code) | phpstan.neon | Reports errors, never edits |
| Rector | Automated upgrade + refactor | rector.php | Rewrites source |
| PHP-CS-Fixer | Coding-standard formatter | .php-cs-fixer.dist.php | Rewrites whitespace/style |
Scope note: Laravel Pint is a thin opinionated wrapper around PHP-CS-Fixer. On a Laravel project use Pint (→ laravel-expert); everywhere else use PHP-CS-Fixer directly, which is what this skill covers.
--dry-run first - Review the diff before applying; commit before a bare runlevel 4check → PHPStan → tests; a formatting diff should fail fast--dev in composer.json; a minor bump can add rules and break CINew project from scratch?
├── Static analysis → PHPStan level 8-9+ from day one (our default; nothing to baseline yet)
├── Style → PHP-CS-Fixer @PER-CS (always-latest) or @PER-CS3.0 (pinned)
└── Rector → withPhpSets() (reads composer.json) + deadCode/codeQuality prepared sets
Legacy codebase?
├── PHPStan → start at a level that passes, generate baseline, raise 1 level per PR
├── Rector → withPhpLevel(n) / withTypeCoverageLevel(n), one level at a time
└── Style → @PER-CS + fix once, then enforce check in CI
| Topic | Reference | Load when |
|-------|-----------|-----------|
| PHPStan levels & baseline | references/phpstan-levels.md | Choosing/raising analysis strictness |
| Rector sets & upgrades | references/rector-upgrades.md | Automating PHP upgrades or refactors |
| PHP-CS-Fixer rule sets | references/php-cs-fixer.md | Configuring code style |
| Template | Use Case |
|----------|----------|
| references/templates/phpstan-neon.md | Complete phpstan.neon (strict + baseline) |
| references/templates/rector-php.md | Complete rector.php (upgrade + quality) |
| references/templates/php-cs-fixer-dist.md | Complete .php-cs-fixer.dist.php (@PER-CS3.0) |
| references/templates/composer-ci.md | composer scripts + GitHub Actions pipeline |
composer require --dev phpstan/phpstan rector/rector friendsofphp/php-cs-fixer
vendor/bin/php-cs-fixer check # style gate (no writes)
vendor/bin/phpstan analyse # type analysis
vendor/bin/rector process --dry-run # preview refactors
→ Full config in references/templates/
phpstan-strict-rules + Bleeding Edge on greenfield projectscomposer.json via withPhpSets()@phpstan-ignore where a real type fix is cheaptesting
Copy self-audit and ban-lists — filler verbs/hype adjectives, slop placeholder names, fake-precise numbers, Title Case headlines, humor in error copy ('Oops!'), em-dash crutch, one copy register per page.
development
Logged-in web apps — dashboards, auth flows, settings, onboarding, data tables, command palettes, modals, toasts. Register `product`: density and glance-speed over marketing polish, no hero/CTA-tricks, every data surface covers empty/loading/error explicitly, tables and dataviz follow preattentive-processing rules.
development
Marketing sites, landing pages, campaign pages — register `brand` (design IS the product). Structure comes from the register's POV + a macrostructure pick, never from copying an inspiration site's section flow. Hero discipline, deviated section order, asymmetric grids, and a silhouette lookalike-test gate before ship.
development
Token-strategy core — OKLCH color rules, neutral tinting, accent-commitment levels, type scale, 8pt spacing grid, touch targets, and the canonical output format of design-system.md (the file the harness gates on). This is routing step 1 of design-method/SKILL.md — read it before design-web/design-webapp/design-ios/design-android, before picking or auditing a single color/type/spacing value.