testing.md

Testing

This package provides a consistent set of Composer scripts for local validation.

Tool references:

• Actionlint for GitHub Actions workflow linting.
• Codespell for spelling checks.
• Composer Require Checker for dependency definition checks.
• Easy Coding Standard (ECS) for coding standards.
• EditorConfig Checker for EditorConfig compliance.
• Gitleaks for secret scanning.
• Infection for mutation testing.
• Markdownlint-cli2 for Markdown linting.
• PHPStan for static analysis.
• PHPUnit for unit tests.
• Prettier for Markdown and YAML formatting checks.
• Rector for automated refactoring.
• Yamllint for YAML linting.
• Zizmor for GitHub Actions security audits.

Automated refactoring (Rector)

Run Rector to apply automated code refactoring. This command modifies files.

composer rector

Validate Rector without modifying files.

composer rector-check

Coding standards (ECS)

Check coding standards without modifying files.

composer ecs-check

Apply coding standard fixes. This command modifies files.

composer ecs

Dependency definition check

Verify that runtime dependencies are correctly declared in composer.json.

composer check-dependencies

Mutation testing (Infection)

Run mutation testing.

composer mutation

Run mutation testing with static analysis enabled.

composer mutation-static

Repository quality checks

Make actionlint (and its ShellCheck helper), codespell, EditorConfig Checker, markdownlint-cli2, Prettier and yamllint available on PATH. Run all repository quality checks:

composer quality

Each tool can also be run separately:

composer actionlint
composer codespell
composer editorconfig-checker
composer markdownlint
composer prettier
composer yamllint

The codespell, EditorConfig Checker and Markdownlint configurations are in .github/linters. Prettier uses .prettierignore as its ignore path; yamllint checks .github.

Static analysis (PHPStan)

Run static analysis.

composer static

Unit tests (PHPUnit)

Run the full test suite.

composer tests

Workflow security checks

Make zizmor and Gitleaks available on PATH. Run both checks, or either one separately:

composer security
composer zizmor
composer gitleaks

Zizmor uses the pedantic persona and may need GitHub API access for online audits. To request an offline audit:

composer zizmor -- --offline

Report offline limitations and hosted CI results separately. Gitleaks scans Git history with the repository's configuration. Review findings instead of disabling the checks.

Passing extra arguments

Composer scripts support forwarding additional arguments using --.

Run PHPUnit with code coverage report generation.

composer tests -- --coverage-html code_coverage

Run PHPStan with a different memory limit.

composer static -- --memory-limit=512M

Next steps

• 📚 Getting started
• 💡 Usage guide and examples
• 🤖 AI agents guide

Back to documentation