Summary
phpmd.baseline.xml now carries 174 entries across 48 files, created in the PR that turned composer phpmd from a no-op into a real gate. This issue tracks burning it down.
Before that PR the script ended || echo 'PHPMD reported violations beyond the baseline — … NOT yet a hard gate.', so it always exited 0. That was not merely a local convenience: the shared CI workflow runs composer phpmd, so the "PHP Quality (phpmd)" job reported success while printing the violations — e.g. run 30760172028 (2026-08-02), green, with dozens of CyclomaticComplexity findings in its log.
What is in the baseline
Measured in nextcloud:32-apache (PHP 8.3.32): 76 violations past the previous baseline, 82 with no baseline at all. Grouped:
| rule |
entries |
| CyclomaticComplexity |
42 |
| NpathComplexity |
26 |
| WeightedMethodCount |
23 |
| ElseExpression |
16 |
| CouplingBetweenObjects |
15 |
| LongMethod |
11 |
| LongClass |
7 |
| BooleanArgumentFlag |
7 |
| LongVariable |
5 |
| ShortVariable |
4 |
| TooManyMethods |
4 |
| StaticAccess |
4 |
| UnusedFormalParameter |
3 |
| LongParameterList |
3 |
| MissingImport |
2 |
| LongClassName |
1 |
| TooManyPublicMethods |
1 |
All of it is complexity/naming debt — none of these rules asserts incorrect behaviour, and the correctness tools are clean on the same tree (phpcs 0, psalm 0, phpstan level 5 0). It was baselined rather than fixed because acting on it means restructuring 48 files with real regression risk and no defect to point at.
Cheapest first slices
UnusedFormalParameter (3) and MissingImport (2) — mechanical, no behaviour change.ElseExpression (16) — early-return conversions, mostly safe and individually reviewable.BooleanArgumentFlag (7) — usually a signal the callee wants splitting.
The complexity families (Cyclomatic/Npath/WeightedMethodCount, 91 entries) should be driven by the files that hurt, not by the count.
Rule going forward
The baseline is a ratchet: any new phpmd violation now fails composer phpmd, composer check:strict and CI. Do not regenerate phpmd.baseline.xml to silence a new finding.
Related
Summary
phpmd.baseline.xmlnow carries 174 entries across 48 files, created in the PR that turnedcomposer phpmdfrom a no-op into a real gate. This issue tracks burning it down.Before that PR the script ended
|| echo 'PHPMD reported violations beyond the baseline — … NOT yet a hard gate.', so it always exited 0. That was not merely a local convenience: the shared CI workflow runscomposer phpmd, so the "PHP Quality (phpmd)" job reported success while printing the violations — e.g. run 30760172028 (2026-08-02), green, with dozens ofCyclomaticComplexityfindings in its log.What is in the baseline
Measured in
nextcloud:32-apache(PHP 8.3.32): 76 violations past the previous baseline, 82 with no baseline at all. Grouped:All of it is complexity/naming debt — none of these rules asserts incorrect behaviour, and the correctness tools are clean on the same tree (phpcs 0, psalm 0, phpstan level 5 0). It was baselined rather than fixed because acting on it means restructuring 48 files with real regression risk and no defect to point at.
Cheapest first slices
UnusedFormalParameter(3) andMissingImport(2) — mechanical, no behaviour change.ElseExpression(16) — early-return conversions, mostly safe and individually reviewable.BooleanArgumentFlag(7) — usually a signal the callee wants splitting.The complexity families (Cyclomatic/Npath/WeightedMethodCount, 91 entries) should be driven by the files that hurt, not by the count.
Rule going forward
The baseline is a ratchet: any new phpmd violation now fails
composer phpmd,composer check:strictand CI. Do not regeneratephpmd.baseline.xmlto silence a new finding.Related