PHPCS: Exclude the vendored adhocore/php-jwt library from linting - #797
PHPCS: Exclude the vendored adhocore/php-jwt library from linting#797obenland wants to merge 1 commit into
Conversation
|
The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the Core Committers: Use this line as a base for the props when committing in SVN: To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook. |
There was a problem hiding this comment.
Pull request overview
Updates the repository PHPCS ruleset to stop linting a vendored third-party JWT library that’s copied into the codebase verbatim, aligning this with existing exclusions for other bundled dependencies.
Changes:
- Adds a PHPCS
<exclude-pattern>forapi.wordpress.org/public_html/dotorg/trac/pr/adhocore-php-jwt/to avoid reporting violations in third-party code.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
…ss ruleset. It's a third-party MIT-licensed library, so coding standards violations reported against it are noise we won't fix. The exclude is scoped to the WordPress ruleset rather than global, because the copy carries local patches (PHP 8.4 compatibility, a private-key check fix) — PHPCompatibilityWP stays active on it so the next PHP version bump still gets flagged, as it was for 8.4. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
0ef4b2f to
1f0084f
Compare
PHPCS reports 14
WordPress.Security.EscapeOutput.ExceptionNotEscapedviolations (plus assorted style noise) againstapi.wordpress.org/public_html/dotorg/trac/pr/adhocore-php-jwt/— the MIT-licensed adhocore/php-jwt library, which we shouldn't hold to WordPress coding standards, matching the existing excludes forplugin-directory/libs/,theme-directory/lib/, andwpf-stripe/stripe-php/.The exclude is scoped to the
WordPressruleset rather than global: this copy is not pristine upstream — it carries local patches (991cf85 for PHP 8.4 implicit-nullable deprecations, 6f3fdbc for a private-key check) — soPHPCompatibilityWPdeliberately stays active on it, preserving the signal that caught the 8.4 breakage in these files. Verified with a canary that deprecated constructs in the directory are still flagged while the WordPress-ruleset violations are silenced.🤖 Generated with Claude Code