Skip to content

Upgrade humanmade/coding-standards to 2.x instead of disabling Composer's security blocking - #66

Merged
danog merged 3 commits into
masterfrom
upgrade-coding-standards
Oct 20, 2026
Merged

danog merged 3 commits into
masterfrom
upgrade-coding-standards

Conversation

@danog

@danog danog commented Oct 20, 2026

Copy link
Copy Markdown
Member

humanmade/coding-standards 1.x requires wp-coding-standards/wpcs 2.3.0, which Composer blocks for a security advisory, so CI installed dependencies with COMPOSER_NO_SECURITY_BLOCKING=1.

Before:

- name: Install dependencies
  run: composer install --ansi --no-interaction --no-progress
  env:
    COMPOSER_NO_SECURITY_BLOCKING: 1
"require-dev": {
    "humanmade/coding-standards": "^1.2",

After:

- name: Install dependencies
  run: composer install --ansi --no-interaction --no-progress
// tools/phpcs/composer.json (2.x needs PHP 8.2, the plugin is tested on 8.1)
"require": {
    "humanmade/coding-standards": "^2.5"
}

https://claude.ai/code/session_01WNSb29tptiTQoc44Tk7XZW

danog added 3 commits October 20, 2026 11:37
humanmade/coding-standards 1.x pins wp-coding-standards/wpcs 2.3.0,
which Composer blocks for its security advisory, so CI disabled the
blocking. 2.x uses WPCS 3 but needs PHP 8.2, while the plugin is
tested down to PHP 8.1, so install it in its own tools/phpcs project,
which the cs-check and cs-fix scripts set up, and drop
COMPOSER_NO_SECURITY_BLOCKING from CI.

Adapt to the new standard: exclude the inline comment full stop sniff,
the WPCS 3 one-structure-per-file sniff (alongside the multiple classes
sniffs already excluded), and the reserved keyword parameter names sniff
for stubs, which keep the parameter names of the functions they
override; apply the automatic fixes and explain the empty catch.

Claude-Session: https://claude.ai/code/session_01WNSb29tptiTQoc44Tk7XZW
HM 2.x requires inline comments to end with a full stop, exclamation
mark or question mark. Punctuate them, and reword the two comments that
ended in commented-out code. The comment of the InvalidDocblock
suppression in tests/unit/BaseTestCase.php is left to the change that
removes it.

Generic.Files.OneObjectStructurePerFile, which WPCS 3 adds to
WordPress-Core, is the same check as the multiple classes sniffs
already excluded, so say so next to its exclusion.

Claude-Session: https://claude.ai/code/session_01WNSb29tptiTQoc44Tk7XZW
…-keyword sniff only for WP-CLI's

get_option($default_value), wp_list_pluck($input_list, $field) and wpdb::get_results($output) had other names, so named arguments failed. Only WP-CLI's $callable and $exit are reserved keywords on purpose.

Claude-Session: https://claude.ai/code/session_01WNSb29tptiTQoc44Tk7XZW
@danog
danog merged commit 43ce8db into master Oct 20, 2026
6 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant