Improve your code quality and secure your projects with automated tools

When we are working alone or as a team on a project and care about quality and security of our developments (and we must), we need to define standards of development and to automate them so that our work does not can only be validate after having met all theses rules.

In the concrete case of teamwork, we would like each team member to meet a certain number of quality and security standards before sharing their code with other team members.

There are tools that automate quality control checks, suggest ways for correction and also correct reported errors.

One of the very well known and very easy tools to use is Grumphp.

Grumphp works with GIT version management tool. You must have previously installed it.

Define code quality standards

The first step is to define the standards that we would like to respect during our developments. In the case of teamwork, the members must agree on the standards to be implemented and which each must respect.

These standards are then written into a centralized tool and updated regularly over time.

Now that we have our quality and code standards set, we need to configure them in Grumphp.

Grumphp

Grumphp allows to run a series of checks in the code during each Git commit.
Concretely, it creates Git hooks that allow you to launch a series of checks in the code each time a user makes a commit on the project.
The standards to be checked during the commit are defined in a configuration file gumphp.yml located at the root of the project.

Installation

Grumphp you can be installed in several way. When you work with composer, you can install it using the following command line:

composer require --dev phpro/grumphp

When the package is installed, GrumPHP will attach itself to the git hooks of your project. You will see following message in the composer logs:

Watch out! GrumPHP is sniffing your commits!

If this message does not appear you can recreate the hooks and the configuration using the following commands lines:

vendor/bin/grumphp configure 
vendor/bin/grumphp git:init 

After installation, Grumphp:

• modifies files: pre-commit and commit-msg and add command lines what will be launched when a user commits a modification. Git hooks files are located in directory .git/hooks.
• creates a configuration file grumphp.yml at the project root.

PHPLint

The PHPLint task will check your source files for syntax errors.

Installation

composer require --dev php-parallel-lint/php-parallel-lint

Configuration

You must modify configuration file:

grumphp:
  tasks:
    phplint: ~

For advanced configuration, please see link: https://github.com/phpro/grumphp/blob/master/doc/tasks/phplint.md

PHPMD (PHP Mess Detector)

The PHPMD task will sniff your code for bad coding standards. It detects possible sources of bugs, too complex methods or expressions.

Installation

composer require --dev phpmd/phpmd

Configuration

You must modify configuration file:

grumphp:
  tasks:
    phpmd: ~

For advanced configuration, please see link: https://github.com/phpro/grumphp/blob/master/doc/tasks/phpmd.md

PHPCSFixer

The PHP-CS-Fixer task will run codestyle checks (PSR1, PSR12).

PHPCSFixer also helps to fix errors.

Installation

composer require --dev friendsofphp/php-cs-fixer

Configuration

You must modify configuration file:

grumphp:
  tasks:
    phpcsfixer: ~

For advanced configuration, please see link: https://github.com/phpro/grumphp/blob/master/doc/tasks/phpcsfixer.md

Phpunit

The Phpunit task will run your unit tests.

Installation

composer require --dev phpunit/phpunit

Configuration

You must modify configuration file:

grumphp:
  tasks:
    phpunit: ~

For advanced configuration, please see link: https://github.com/phpro/grumphp/blob/master/doc/tasks/phpunit.md

PHPStan (PHP Static Analysis Tool)

The PHPStan task focuses on finding errors in your code without actually running it. It catches whole classes of bugs even before you write tests for the code.
It detects structural problems in the code which can lead to bugs.

PHPStan also helps to fix errors.

Installation

composer require --dev phpstan/phpstan

Configuration

You must modify configuration file:

grumphp:
  tasks:
    phpstan: ~

For advanced configuration, please see link: https://github.com/phpro/grumphp/blob/master/doc/tasks/phpstan.md

The final configuration file looks like: 

grumphp:
  tasks:
    phplint: ~
    phpcsfixer: ~
    phpmd: ~
    phpunit: ~

Execution

After finishing the configuration, when we commit a modification then Grumphp starts the checks.

We also can run the verification from this command line: 

vendor/bin/grumphp run

Example of application

We configured Grumphp on project https://github.com/oumarkonate/design-patterns and started verification.

Reading the console, Phpcsfixer and Phpmd help to fix reported errors.

After fixing errors:

Go further

For advanced configuration, see the official Grumphp repository Grumphp official repository

It’s also possible to add rules on commit messages, by modifying file .git/hooks/commit-msg