backdevs / laravel-dotenv-sniffer Goto Github PK

As the title states, the README should be updated to include examples using the backdevs/desniff image and have it as the preferred method of using the tool.

Also, a PHAR usage example would be nice.

For simpler use in CI/CD pipelines, the tool should be containerized

As the tool statically analyzes PHP source code, it can very well be containerized to be easier to integrate into CI/CD pipelines.
It will also allow projects that have dependency conflicts with the tool to still use it.

What needs to be done:

• Create docker hub repository backdevs/desniff (should probably be pushed to github's registry too due to recent changes Docker's organizations pricing scheme)
• Add Dockerfile to project
• Add gitlab workflow to build and push the image to the registry

What needs to be done:

• Add squizlabs/php_codesniffer as a dev requirement
• Add backdevs/coding-standard as a dev requirement (not yet available)
• Add phpcs.xml file that uses the backdevs coding-standard
• Add phpcs job in the tests.yml workflow that runs vendor/bin/phpcs

Note: As backdevs/coding-standard is still a WIP this issue will have to wait.

Similar to what phpunit, phpcs, phpstan etc. are doing, a desniff.yml configuration file should be supported and automatically loaded if present and require CLI arguments only if they're not defined in the config file.

The file should support all the existing CLI arguments.

We should provide a default configuration file that contains the default values for all the existing CLI arguments:

• <env-file> - .env.example
• <paths> - ./config
• --fail-code - 1
• --warn-with-default - false
• --ansi - true
• --quiet - false

The default configuration file should be generated using an init command:

./vendor/bin/desniff init

The configuration file should be automatically loaded if present but also the user should be able to provide it using an argument (-c | --config and --fail-code should become -f:

./vendor/bin/desniff -c desniff.ci.yml

As the title says, the project will be renamed to laravel-dotenv-sniffer.

Things to update:

• Repository name
• Packagist package?
• README urls & title
• composer.json url

A better, nicer README is needed

Needs:

• Nicer header
• Notice about how it's best suited for laravel projects at the moment
• Better examples

Since GitHub actions using node 16 have been deprecated, we should use actions' latest versions.

References:

• https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/

Depends on #113

This can (should?) be done similar to what phpunit or phpcs do with their configuration files (phpcs.xml and phpunit.xml).

We can have a desniff.yml file that can look something like this:

excluded_files:
    - ./config/view.php
    - ./config/queue.php

excluded_vars:
    # config/app.php
    - ASSET_URL

   # config/view.php
    - VIEW_COMPILED_PATH

   # config/broadcasting.php
    - PUSHER_APP_KEY
    - PUSHER_APP_SECRET
    - PUSHER_APP_ID
    - PUSHER_APP_CLUSTER

To improve compatibility and ease of use

• This tool should be distributed as a PHAR
• #3 should use the PHAR

What needs to be done

• Add a box.json.dist configuration file for box-project/box
• Use backdevs/box Docker image to "compile" the tool to a phar during the CI workflow

Being that this project is also distributed as a composer package, composer.lock doesn't really make much sense.

It'll also reduce dependabot PRs.