Audit-only measurement of every suppression and baseline in this repo. Nothing was removed or changed — all numbers come from throwaway copies re-run in a container. Part of a 22-repo fleet sweep; see the summary issue for the fleet picture.
PHPMD: reported vs true
| arm |
violations |
what it means |
reported (composer phpmd as configured) |
6 |
what CI prints today |
| baseline neutralised |
201 |
+ what phpmd.baseline.xml hides |
baseline + @SuppressWarnings neutralised |
218 |
true current state |
Delta: 6 → 218 (+212).
phpmd.baseline.xml holds 174 entries, wired via --baseline-file. Note it stays active even if that flag is dropped — PHPMD auto-discovers this filename.
Baselines
| file |
entries |
wiring |
phpmd.baseline.xml |
174 |
flagged |
psalm-baseline.xml |
0 |
n/a |
phpstan-baseline.neon |
2 |
included |
Inline suppressions (lib/)
@SuppressWarnings: 13 — 2 carry a written reason, 11 are bare.
Triage on whether a reason exists and still holds — not on the rule name.
⚠️ Inert <exclude-pattern> (config bug)
phpmd.xml nests 1 <exclude-pattern> inside a <rule> element. PHPMD only honours <exclude-pattern> as a direct child of <ruleset>, so this exemption has never applied.
Shared-template defect across 19 of 21 repos — fix once in the template.
Suggested burn-down order
- Fix the exclude-pattern (above) — cheapest; retires interface-mandated noise legitimately.
- Triage the 11 bare
@SuppressWarnings — each gets a reason or goes.
- Resolve orphan/undeclared baselines — they mislead without protecting.
- Burn down the remainder by rule cluster, largest first.
Caveats measured, not assumed
UndefinedVariable here is overwhelmingly false positives from by-ref out-params (preg_match($re,$s,$matches), openssl_*(output: $var)). The rule name is not a defect signal.- Much
UnusedFormalParameter mass is interface-mandated (Migration steps, listener signatures) and cannot be removed.
Audit only — no code, config or baseline modified. Measured on development in a fresh clone; PHP 8.4 / PHPMD 2.15.0; exit code checked on every run.
Audit-only measurement of every suppression and baseline in this repo. Nothing was removed or changed — all numbers come from throwaway copies re-run in a container. Part of a 22-repo fleet sweep; see the summary issue for the fleet picture.
PHPMD: reported vs true
composer phpmdas configured)phpmd.baseline.xmlhides@SuppressWarningsneutralisedDelta: 6 → 218 (+212).
phpmd.baseline.xmlholds 174 entries, wired via--baseline-file. Note it stays active even if that flag is dropped — PHPMD auto-discovers this filename.Baselines
phpmd.baseline.xmlpsalm-baseline.xmlphpstan-baseline.neonInline suppressions (
lib/)@SuppressWarnings: 13 — 2 carry a written reason, 11 are bare.Triage on whether a reason exists and still holds — not on the rule name.
<exclude-pattern>(config bug)phpmd.xmlnests 1<exclude-pattern>inside a<rule>element. PHPMD only honours<exclude-pattern>as a direct child of<ruleset>, so this exemption has never applied.Shared-template defect across 19 of 21 repos — fix once in the template.
Suggested burn-down order
@SuppressWarnings— each gets a reason or goes.Caveats measured, not assumed
UndefinedVariablehere is overwhelmingly false positives from by-ref out-params (preg_match($re,$s,$matches),openssl_*(output: $var)). The rule name is not a defect signal.UnusedFormalParametermass is interface-mandated (Migration steps, listener signatures) and cannot be removed.Audit only — no code, config or baseline modified. Measured on
developmentin a fresh clone; PHP 8.4 / PHPMD 2.15.0; exit code checked on every run.