# PHP Tooling

> Configure PHP ecosystem tooling, dependency management, and static analysis. Use when managing Composer dependencies, running PHPStan, or configuring PHP build tools.

- Skill: `hoangnguyen0403/php-tooling` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add hoangnguyen0403/php-tooling`
- Raw SKILL.md: https://api.skillmd.com/api/skills/hoangnguyen0403/php-tooling/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: HoangNguyen0403 (https://skillmd.com/u/hoangnguyen0403)
- Updated: 2026-08-19
- Page: https://skillmd.com/skills/hoangnguyen0403/php-tooling

---

# PHP Tooling

## **Priority: P2 (MEDIUM)**

## Structure

```text
project/
├── composer.json
├── phpstan.neon
└── .php-cs-fixer.php
```

## Implementation Guidelines

- **Composer**: Always **commit `composer.lock`** for applications. Use **`composer audit`** and **`composer install in CI`** (not `update`) for locked versions.
- **Autoloading**: Strictly enforce **PSR-4** autoloading in **`composer.json`** (e.g., **`"psr-4": {"App\\": "src/"}`** — ensure backslashes escaped). Run **`composer dump-autoload`** after changes.
- **Static Analysis**: Mandate **PHPStan** (Level 5+) or **Psalm** in CI. Install via **`composer require --dev phpstan/phpstan`**. Create **`phpstan.neon`** with **`parameters: { paths: [src], level: 6 }`**. Run via **`vendor/bin/phpstan analyse`**.
- **Linting**: Automate **PSR-12** standards via **`composer require --dev friendsofphp/php-cs-fixer`**. Configure in **`.php-cs-fixer.php`** with **`$config->setRules(['@PSR12' => true])`**. Use **`php-cs-fixer`** to enforce standards.
- **Execution**: Use **`PHP 8.1+`** to leverage performance improvements (JIT, OpCache).
- **Scripts**: Define standard task **`"scripts": {`** in **`composer.json`** (**`"analyze": "phpstan analyse", "test": "phpunit", "check": ["@fix", "@analyze", "@test"]}`**). Run with **`composer check`**.
- **Debugging**: Use **`Xdebug`** for local development only. **Remove xdebug.so** from prod config or **set XDEBUG_MODE=off** in production.
- **Docker**: Use **Multi-stage Dockerfiles** with **`php:8.x-fpm`** or **`php:8.x-cli`** base images.

## Anti-Patterns

- **No manual `require`**: Use Composer PSR-4 autoloading only.
- **No blind composer updates**: Review `composer.lock` diff first.
- **No Xdebug in production**: Disable extension in prod env.
- **No `vendor/` in git**: Exclude via `.gitignore`; use Composer.

## Canonical response anchors

When this skill applies, preserve the following domain terminology or equivalent concrete examples in the answer when relevant:
- Always commit composer,always
- Remove xdebug.so
- composer check
- composer install in CI
- paths: [src]
- set XDEBUG_MODE=off