Skip to content

Modernize skeleton to PHP 8.2+, PSR-12, and PHPUnit 11/12 - #1

Merged
jasdeepkhalsa merged 1 commit into
masterfrom
claude/phpunit-skeleton-modernize-eptozn
Jul 28, 2026
Merged

Modernize skeleton to PHP 8.2+, PSR-12, and PHPUnit 11/12#1
jasdeepkhalsa merged 1 commit into
masterfrom
claude/phpunit-skeleton-modernize-eptozn

Conversation

@jasdeepkhalsa

@jasdeepkhalsa jasdeepkhalsa commented Jul 28, 2026

Copy link
Copy Markdown
Owner

Summary

This project hadn't moved since the PHP 5.4/PHPUnit 3.7 era. This PR brings it up to date: modern PHP (8.2+), PSR-4 autoloading, PSR-12 code style, current PHPUnit (11/12), and a GitHub Actions pipeline — using DBDiff as a reference for what a modern PHP project in this org looks like (PSR-4 layout, composer scripts, GitHub Actions matrix).

  • Dependencies: phpunit/phpunit bumped from the long-EOL 3.7.* to ^11.0 || ^12.0. Dropped phpunit/dbunit and phpunit/phpunit-selenium — both abandoned packages that the skeleton never actually used, and both irrelevant to a plain unit-testing starter kit.
  • Autoloading: PSR-0 → PSR-4. lib/Application/Example.php and tests/Application/ExampleTest.php flattened to lib/Example.php and tests/ExampleTest.php so the namespace root maps 1:1 onto the source directory (same convention DBDiff uses for its src/ tree), instead of duplicating the namespace name as a subdirectory.
  • Code: declare(strict_types=1), scalar/union type hints, PSR-12 formatting. Tests converted to PHPUnit's attribute-based #[DataProvider] and expectException() — the old @dataProvider/@expectedException doc-comment annotations and the PHPUnit_Framework_TestCase base class no longer exist in current PHPUnit.
  • phpunit.xml: updated to the PHPUnit 11 schema, <coverage><include> replaced with the current <source><include> block.
  • Tooling: added PHP-CS-Fixer (PSR-12 ruleset) with composer cs-check/cs-fix scripts.
  • CI: replaced .travis.yml (PHP 5.4/5.5/5.6, all long past EOL and unpatched) with .github/workflows/tests.yml, testing PHP 8.2–8.4 and running composer validate, the CS check, and the test suite on every push/PR.

Security

  • Removed the composer.phar binary that was committed directly to the repo — a stale, unpatched executable checked into version control is itself a supply-chain risk; CI now installs Composer via the setup-php action's tool cache instead.
  • Dropped phpunit/dbunit and phpunit/phpunit-selenium, both abandoned/unmaintained dev dependencies that unnecessarily widened the install's attack surface.
  • Pushing this branch surfaced a GitHub Dependabot alert (1 high severity) against the previous composer.json on master — consistent with known CVEs in the ancient PHPUnit 3.7.x line this PR removes. The alert should clear automatically once this merges, since the vulnerable version constraint no longer exists on the branch.
  • composer audit against the new dependency set (phpunit/phpunit, friendsofphp/php-cs-fixer) reports no known vulnerability advisories.
  • No secrets, credentials, or hardcoded tokens found anywhere in the repository.

Test plan

  • composer validate --strict passes with no warnings
  • composer install resolves cleanly, PSR-4 autoload generates with zero "does not comply" warnings
  • composer test (./vendor/bin/phpunit) — 4 tests, 4 assertions, all green
  • composer cs-check (PHP-CS-Fixer dry-run) — 0 files need fixing
  • composer audit — no advisories found
  • CI workflow will validate the PHP 8.2/8.3/8.4 matrix once this PR is opened

- Bump PHPUnit from the long-EOL 3.7.* to ^11.0 || ^12.0, dropping the
  unmaintained phpunit/dbunit and phpunit/phpunit-selenium dev
  dependencies that were unused by the skeleton and carried unnecessary
  supply-chain risk.
- Switch autoloading from PSR-0 to PSR-4 and flatten lib/Application and
  tests/Application into lib/ and tests/ so the namespace root maps
  directly onto the source directory (mirrors DBDiff's src/ layout).
- Rewrite Example.php and ExampleTest.php for PHP 8.2+: strict_types,
  scalar/union type hints, constructor-less typed property, PHPUnit
  attribute-based #[DataProvider] instead of the removed @dataProvider/
  @ExpectedException annotations, and PSR-12 formatting throughout.
- Modernize phpunit.xml to the PHPUnit 11 schema with a <source> block
  replacing the legacy <coverage><include> config.
- Add PHP-CS-Fixer with a PSR-12 ruleset plus composer cs-check/cs-fix
  scripts.
- Replace .travis.yml (PHP 5.4/5.5/5.6, long EOL and unpatched) with a
  GitHub Actions workflow that validates composer.json, checks coding
  standards, and runs tests across PHP 8.2-8.4.
- Remove the committed composer.phar binary (stale, unpatched
  executable checked into version control) in favor of installing
  Composer via the CI tool cache / the developer's own install.
- Update README for the new install/test/customize workflow.

composer audit reports no known vulnerabilities in the new dependency
set.
@jasdeepkhalsa
jasdeepkhalsa merged commit bd84b37 into master Jul 28, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants