PHPackages neophp/codechecker-package - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. neophp/codechecker-package ActiveLibrary neophp/codechecker-package ========================== Configurable static code rule checker for NeoPHP projects v0.2.0(yesterday)01↑2900%MITPHPPHP >=8.5CI passing Since Aug 8Pushed yesterdayCompare [ Source](https://github.com/NeoPHP-Dev/neo-codechecker-package)[ Packagist](https://packagist.org/packages/neophp/codechecker-package)[ RSS](/packages/neophp-codechecker-package/feed)WikiDiscussions main Synced today READMEChangelog (2)DependenciesVersions (3)Used By (0) CodeChecker Package =================== [](#codechecker-package) A configurable static code rule checker for NeoPHP. Define rules once, in a config file, and scan an entire project with a single command — forbidden namespace usages, forbidden code patterns, or required ones, all defined declaratively rather than hard-coded into a script. --- Structure --------- [](#structure) ``` codechecker-package/ ├── composer.json ├── README.md ├── src/ │ ├── NeoCodeCheckerPackage.php │ ├── Commands/ │ │ ├── CodeCheckerScanCommand.php │ │ └── CodeCheckerAddRuleCommand.php │ └── Service/ │ ├── RuleLoader.php │ └── RuleChecker.php └── config/ └── codechecker-rules.config.php ``` --- Installation ------------ [](#installation) ``` php bin/neo package:require neophp/codechecker-package --project=MyProject ``` Register it in the project's `Config/app.config.php`: ``` return [ // ... 'packages' => [ \Vendor\NeoPHP\CodeCheckerPackage\NeoCodeCheckerPackage::class, ], ]; ``` On first boot, `config/codechecker-rules.config.php` is copied to `Config/Packages/CodeChecker/codechecker-rules.config.php` in your project — pre-populated with a few baseline rules (no `var_dump()`, no `dd()`, no `die()` in controllers, entities must carry `#[Entity]`). Edit this file freely; it is never overwritten once it exists. --- Usage ----- [](#usage) ### Scan the project [](#scan-the-project) ``` php bin/neo codechecker:scan --project=MyProject ``` ``` Scanning MyProject… ✘ App/Controllers/ReportsController.php:34 Rule: no-var-dump No var_dump() calls should remain in the codebase 1 violation(s) found. ``` Exits with a non-zero code if any violation is found — usable as a CI step, the same way `phpstan analyse` is typically wired into a pipeline. ### Add a rule interactively [](#add-a-rule-interactively) Instead of hand-editing the config array, add a rule step by step: ``` php bin/neo codechecker:add-rule --project=MyProject ``` ``` Rule name: no-raw-sql-in-repositories Description: Repositories must never build raw SQL query strings Applies to (namespace pattern, * for all): App\Repository\* Rule type [1] forbidden_use — a specific `use X;` must NOT appear [2] forbidden_call — a specific string must NOT appear [3] required_use — a specific `use X;` MUST appear [4] required_call — a specific string MUST appear Type (1-4): 2 Value (class-string to require/forbid, or string pattern): ->query( ✔ Rule 'no-raw-sql-in-repositories' added to codechecker-rules.config.php ``` The existing rules in the file are preserved — the new rule is appended to the array. --- Rule format ----------- [](#rule-format) Each rule is an associative array with 5 keys: ``` [ 'name' => 'unique-rule-name', 'description' => 'Shown in scan output when this rule is violated', 'applies_to' => 'App\\Controllers\\*', // namespace glob pattern, or '*' for every file 'type' => 'forbidden_call', // see table below 'value' => 'var_dump(', // what to search for ], ``` TypeChecks`forbidden_use`A specific `use X;` statement must **not** appear in the file`forbidden_call`A specific string must **not** appear anywhere in the file`required_use`A specific `use X;` statement **must** appear in the file`required_call`A specific string **must** appear anywhere in the file`forbidden_use`/`required_use` and `forbidden_call`/`required_call` are checked identically under the hood — both search for `value` as a plain substring of the file's content. `_use` variants exist as a naming convention for readability (checking a `use` statement specifically) but technically behave the same as `_call`. Write the full string you're checking for either way (e.g. `'use Neo\\Core\\Database\\DatabaseManager;'`for a `forbidden_use` rule, not just the class name). `applies_to` supports a single trailing wildcard (`App\Controllers\*`matches any class under that namespace) or `*` to apply to every scanned file, regardless of namespace. --- Known limitations ----------------- [](#known-limitations) - **Substring matching, not real static analysis.** A rule matches on plain text presence in the file — it does not parse the AST, so it cannot distinguish a real usage from, say, a match inside a comment or a string literal. This makes rules simple to write and fast to run, at the cost of occasional false positives — review scan results, don't treat them as infallible. - **`applies_to` matches on namespace, not file path.** A file's namespace must be resolvable (a valid PHP class with a `namespace`declaration) for the rule to apply — non-class files are skipped entirely. - **The config file is rewritten from scratch by `codechecker:add-rule`**using a custom array exporter (to keep `[]` short array syntax rather than PHP's default `array(...)` from `var_export()`). Any hand-written comments in `codechecker-rules.config.php` will be lost the next time you run this command — edit the file directly instead if you want to keep comments, and only use `add-rule` for quick, comment-free additions. --- License ------- [](#license) MIT ### Health Score 39 — LowBetter than 84% of packages Maintenance100 Actively maintained with recent releases Popularity2 Limited adoption so far Community8 Small or concentrated contributor base Maturity42 Maturing project, gaining track record Bus Factor1 Top contributor holds 81.8% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~0 days Total 2 Last Release 1d ago ### Community Maintainers ![](https://avatars.githubusercontent.com/u/212323688?v=4)[BBoezio](/maintainers/BenjiLeLoustik)[@BenjiLeLoustik](https://github.com/BenjiLeLoustik) --- Top Contributors [![BenjiLeLoustik](https://avatars.githubusercontent.com/u/212323688?v=4)](https://github.com/BenjiLeLoustik "BenjiLeLoustik (9 commits)")[![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4)](https://github.com/github-actions[bot] "github-actions[bot] (2 commits)") ### Embed Badge ![Health badge](/badges/neophp-codechecker-package/health.svg) ``` [![Health](https://phpackages.com/badges/neophp-codechecker-package/health.svg)](https://phpackages.com/packages/neophp-codechecker-package) ``` PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)