Php Conventions

---
name: php-conventions
description: PHP code conventions covering PHP 8.2+ strict types, PSR-12 formatting, PHPStan/Psalm static analysis, PHPUnit, Composer dependency management, PSR-4 autoloading, and security. Load when writing or reviewing PHP code.
---

- PHP 8.2+, `declare(strict_types=1)`, typed properties, union types, enums, readonly classes.
- Formatting: PSR-12 via a fixer (e.g., PHP_CodeSniffer/phpcbf or php-cs-fixer). Static analysis: a strict analyzer (e.g., PHPStan at max level or Psalm).
- Testing: PHPUnit with `@dataProvider`, 80%+ coverage.
- Error handling: specific exceptions extending `RuntimeException`, constructor promotion for value objects.
- First-class callable syntax (`$fn = strlen(...)`) for callbacks. Arrow functions (`fn() =>`) for simple closures.
- Dependencies: Composer with `composer.lock` committed, `^` version constraints. `composer audit` in CI.
- Security: require `roave/security-advisories` as dev dependency to block vulnerable packages.
- PSR-4 autoloading exclusively — no `require`/`include` for classes.
- Intersection types for strict parameter contracts. Named arguments for readability.
- Anti-patterns: `@` suppression, `eval()`, dynamic property access, `extract()`.