phpcs.xml.dist

<?xml version="1.0"?>
<ruleset name="RoxyAPI">
	<description>PHPCS rules for the RoxyAPI WordPress plugin.</description>

	<file>.</file>
	<exclude-pattern>/vendor/*</exclude-pattern>
	<exclude-pattern>/node_modules/*</exclude-pattern>
	<exclude-pattern>/tests/*</exclude-pattern>
	<exclude-pattern>/build/*</exclude-pattern>
	<exclude-pattern>/blocks/generated/*</exclude-pattern>
	<exclude-pattern>/src/Generated/*</exclude-pattern>

	<arg value="sp"/>
	<arg name="extensions" value="php"/>
	<arg name="colors"/>
	<arg name="parallel" value="8"/>

	<config name="minimum_supported_wp_version" value="6.5"/>
	<config name="testVersion" value="7.4-"/>

	<rule ref="WordPress">
		<!-- PSR-4 autoloading requires PascalCase filenames, not hyphenated-lowercase -->
		<exclude name="WordPress.Files.FileName.InvalidClassFileName"/>
		<exclude name="WordPress.Files.FileName.NotHyphenatedLowercase"/>
		<!-- Yoda conditions: WP style preference, not a code quality issue -->
		<exclude name="WordPress.PHP.YodaConditions.NotYoda"/>
	</rule>

	<!-- Doc comments: file docblocks are sufficient for PSR-4 classes -->
	<rule ref="WordPress-Docs">
		<exclude name="Squiz.Commenting.FunctionComment.Missing"/>
		<exclude name="Squiz.Commenting.ClassComment.Missing"/>
		<exclude name="Squiz.Commenting.VariableComment.Missing"/>
	</rule>

	<!-- Shortcode render() signatures require $atts, $content, $tag per WP API -->
	<rule ref="Generic.CodeAnalysis.UnusedFunctionParameter">
		<exclude name="Generic.CodeAnalysis.UnusedFunctionParameter.FoundAfterLastUsed"/>
		<exclude name="Generic.CodeAnalysis.UnusedFunctionParameter.Found"/>
	</rule>

	<!-- extract() is used safely in Templates::render() with EXTR_SKIP -->
	<rule ref="WordPress.PHP.DontExtract.extract_extract">
		<exclude-pattern>/src/Support/Templates.php</exclude-pattern>
	</rule>

	<!-- base64_encode/decode used for encryption, not obfuscation -->
	<rule ref="WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode">
		<exclude-pattern>/src/Support/Encryption.php</exclude-pattern>
	</rule>
	<rule ref="WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode">
		<exclude-pattern>/src/Support/Encryption.php</exclude-pattern>
	</rule>

	<!-- Cache flush requires direct DB query -->
	<rule ref="WordPress.DB.DirectDatabaseQuery.DirectQuery">
		<exclude-pattern>/src/Api/Cache.php</exclude-pattern>
	</rule>
	<rule ref="WordPress.DB.DirectDatabaseQuery.NoCaching">
		<exclude-pattern>/src/Api/Cache.php</exclude-pattern>
	</rule>

	<!--
		Suppress NonPrefixedVariableFound for templates and block render.php.
		These files receive their variables either via Templates::render's
		extract($vars, EXTR_SKIP) (so $signup_url, $key_input, etc. are
		LOCAL function-scope vars, not globals) or via the WordPress block
		API which passes $attributes, $content, $block, $sign, $date,
		$period, $reading_type, $wrapper_attributes by exact unprefixed
		name (the contract is core's, we cannot prefix and still satisfy
		the API).

		PHPCS's static analyzer cannot distinguish "top-of-file scalar
		assignment after extract()" from "actual global". Without this
		suppression Plugin Check's plugin_repo category surfaces ~70
		false-positive warnings that wp.org reviewers see and have to
		mentally filter every time. Suppressing here keeps the report
		clean without per-line phpcs:ignore comments scattered across
		every template and render file.
	-->
	<rule ref="WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedVariableFound">
		<exclude-pattern>/templates/*</exclude-pattern>
		<exclude-pattern>/blocks/*/render.php</exclude-pattern>
	</rule>

	<rule ref="WordPress.WP.I18n">
		<properties>
			<property name="text_domain" type="array">
				<element value="roxyapi"/>
			</property>
		</properties>
	</rule>

	<rule ref="PHPCompatibilityWP"/>
</ruleset>