Upgrade humanmade/coding-standards to 2.x instead of disabling Composer's security blocking

.github/workflows/test.yml

@@ -31,9 +31,6 @@ jobs:
 
       - name: Install dependencies
         run: composer install --ansi --no-interaction --no-progress
-        env:
-          # humanmade/coding-standards requires wp-coding-standards/wpcs 2.3.0, which has a security advisory
-          COMPOSER_NO_SECURITY_BLOCKING: 1
 
       - name: Run Tests
         run: vendor/bin/phpunit

.gitignore

@@ -3,3 +3,4 @@ composer.lock
 /stubs/wordpress/
 /stubs/vendor/
 /vendor/
+/tools/phpcs/vendor/

composer.json

@@ -28,7 +28,6 @@
 	},
 	"require-dev": {
 		"dg/bypass-finals": "^1.5",
-		"humanmade/coding-standards": "^1.2",
 		"phpunit/phpunit": "^10.5 || ^11.5",
 		"psalm/plugin-phpunit": "^0.21"
 	},
@@ -49,9 +48,6 @@
 		}
 	},
 	"config": {
-		"allow-plugins": {
-			"dealerdirect/phpcodesniffer-composer-installer": true
-		},
 		"preferred-install": {
 			"vimeo/psalm": "source"
 		},
@@ -64,8 +60,14 @@
 			"@analyze"
 		],
 		"analyze": "psalm",
-		"cs-check": "phpcs -ps --colors",
-		"cs-fix": "phpcbf",
+		"cs-check": [
+			"@composer --working-dir=tools/phpcs update --no-interaction --quiet",
+			"tools/phpcs/vendor/bin/phpcs -ps --colors"
+		],
+		"cs-fix": [
+			"@composer --working-dir=tools/phpcs update --no-interaction --quiet",
+			"tools/phpcs/vendor/bin/phpcbf"
+		],
 		"test": "codecept run",
 		"test-coverage": "phpunit --colors=always --coverage-clover clover.xml",
 		"generate-wordpress-stubs": "cd wordpress ; composer init -n ; composer require "

phpcs.xml.dist

@@ -23,9 +23,10 @@
 		<exclude name="Squiz.Commenting.FunctionComment.ParamNameNoMatch" />
 		<exclude name="Squiz.Commenting.FunctionCommentThrowTag.Missing" />
 
-		<!-- Exclude multiple classes sniff -->
+		<!-- Exclude multiple classes sniffs (WPCS 3 adds the same check as Generic.Files.OneObjectStructurePerFile) -->
 		<exclude name="HM.Classes.OnlyClassInFile.FoundMultipleDeclarations" />
 		<exclude name="PSR1.Classes.ClassDeclaration.MultipleClasses" />
+		<exclude name="Generic.Files.OneObjectStructurePerFile.MultipleFound" />
 
 		<!-- Exclude snake_case property sniffs -->
 		<exclude name="WordPress.NamingConventions.ValidVariableName.PropertyNotSnakeCase" />

stubs/overrides.php

@@ -17,6 +17,7 @@ class WP_CLI {
 	 * } $args
 	 * @return bool
 	 */
+	// phpcs:ignore Universal.NamingConventions.NoReservedKeywordParameterNames -- WP-CLI's parameter name, for named arguments.
 	public static function add_command( string $name, $callable, array $args = [] ) {}
 
 	/**
@@ -29,6 +30,7 @@ public static function add_command( string $name, $callable, array $args = [] )
 	 *     : null
 	 * )
 	 */
+	// phpcs:ignore Universal.NamingConventions.NoReservedKeywordParameterNames -- WP-CLI's parameter name, for named arguments.
 	public static function error( $message, $exit = true ) {}
 }
 
@@ -43,7 +45,7 @@ public function prepare( $query, $args ) {}
 	/**
 	 * @template TObject of ARRAY_A|ARRAY_N|OBJECT|OBJECT_K
 	 * @param string|null $query
-	 * @psalm-param TObject $object
+	 * @psalm-param TObject $output
 	 * @return (
 	 *     TObject is OBJECT
 	 *     ? list<ArrayObject<string, string>>
@@ -56,7 +58,7 @@ public function prepare( $query, $args ) {}
 	 *       )
 	 * )|null
 	 */
-	public function get_results( $query = null, $object = \OBJECT ) {}
+	public function get_results( $query = null, $output = \OBJECT ) {}
 }
 
 /**
@@ -117,10 +119,10 @@ function wp_parse_url( string $url, int $component = -1 ) {}
 
 /**
  * @param string $option
- * @param mixed $default
+ * @param mixed $default_value
  * @return mixed
  */
-function get_option( string $option, $default = null ) {}
+function get_option( string $option, $default_value = null ) {}
 
 /**
  * @return array[] {
@@ -144,14 +146,14 @@ function get_option( string $option, $default = null ) {}
  *   type: string,
  * }>
  */
-function get_settings_errors( $setting = '', $sanitize = false ) : array {}
+function get_settings_errors( $setting = '', $sanitize = false ): array {}
 
 /**
  * @param string $path
  * @param 'https'|'http'|'relative'|'rest' $scheme
  * @return string
  */
-function home_url( string $path = '', $scheme = null ) : string {}
+function home_url( string $path = '', $scheme = null ): string {}
 
 /**
  * @template TArgs of array<array-key, mixed>
@@ -166,13 +168,13 @@ function wp_parse_args( $args, $defaults ) {}
  * @param WP_Error|mixed $error
  * @psalm-assert-if-true WP_Error $error
  */
-function is_wp_error( $error ) : bool {}
+function is_wp_error( $error ): bool {}
 
 /**
  * @template T
  * @template K
- * @param array<array-key, array<K, T>> $list
- * @param K $column
+ * @param array<array-key, array<K, T>> $input_list
+ * @param K $field
  * @return list<T>
  */
-function wp_list_pluck( array $list, string $column, string $index_key = null ) : array {}
+function wp_list_pluck( array $input_list, string $field, string $index_key = null ): array {}

tests/PluginTest.php

@@ -16,14 +16,14 @@ class PluginTest extends TestCase {
 	/**
 	 * @return void
 	 */
-	public function setUp() : void {
+	public function setUp(): void {
 		$this->registration = $this->prophesize( RegistrationInterface::class );
 	}
 
 	/**
 	 * @test
 	 */
-	public function hasEntryPoint() : void {
+	public function hasEntryPoint(): void {
 		$this->expectNotToPerformAssertions();
 		$plugin = new Plugin();
 		$plugin( $this->registration->reveal(), null );

tests/bootstrap.php

@@ -2,5 +2,5 @@
 
 require __DIR__ . '/../vendor/autoload.php';
 
-// Psalm's test classes extend classes that are final outside of its test suite
+// Psalm's test classes extend classes that are final outside of its test suite.
 DG\BypassFinals::enable();

tests/unit/BaseTestCase.php

@@ -10,7 +10,7 @@
 use Psalm\Tests\Internal\Provider;
 
 abstract class BaseTestCase extends Psalm\Tests\TestCase {
-	public function setUp() : void {
+	public function setUp(): void {
 		parent::setUp();
 		$this->project_analyzer->getConfig()->initializePlugins( $this->project_analyzer );
 		$this->project_analyzer->getConfig()->visitStubFiles( $this->project_analyzer->getCodebase() );
@@ -19,7 +19,7 @@ public function setUp() : void {
 	/**
 	 * @return Config
 	 */
-	protected function makeConfig() : Config {
+	protected function makeConfig(): Config {
 		$config = new TestConfig();
 		$config->addPluginClass( 'PsalmWordPress\\Plugin' );
 		return $config;
@@ -30,7 +30,7 @@ public function analyzeFile(
 		\Psalm\Context $context,
 		bool $track_unused_suppressions = true,
 		bool $taint_flow_tracking = false
-	) : void {
+	): void {
 		$codebase = $this->project_analyzer->getCodebase();
 		$codebase->addFilesToAnalyze( [ $file_path => $file_path ] );
 
@@ -54,7 +54,7 @@ public function __construct() {
 		$this->setAdvancedErrorLevel( 'InvalidDocblock', [ [ 'type' => 'suppress', 'directory' => [ [ 'name' => 'vendor' ] ] ] ], 'error' );
 	}
 
-	protected function getContents() : string {
+	protected function getContents(): string {
 		return '<?xml version="1.0"?>
 			<projectFiles>
 				<directory name="./" />

tests/unit/FiltersTest.php

@@ -12,7 +12,7 @@ class FiltersTest extends BaseTestCase {
 	/**
 	 * @return iterable<string,array{string,assertions?:array<string,string>,error_levels?:string[]}>
 	 */
-	public static function providerValidCodeParse() : iterable {
+	public static function providerValidCodeParse(): iterable {
 		return [
 			'add_filter with docblock' => [
 				<<<'EOD'
@@ -67,7 +67,7 @@ public static function providerValidCodeParse() : iterable {
 	/**
 	 * @return iterable<string,array{string,error_message:string,2?:string[],3?:bool,4?:string}>
 	 */
-	public static function providerInvalidCodeParse() : iterable {
+	public static function providerInvalidCodeParse(): iterable {
 		return [
 			'add_filter fails wrong types' => [
 				<<<'EOD'

tools/phpcs/composer.json

@@ -0,0 +1,11 @@
+{
+	"description": "Psalm plugin for WordPress - coding standards, which need a newer PHP than the plugin supports",
+	"require": {
+		"humanmade/coding-standards": "^2.5"
+	},
+	"config": {
+		"allow-plugins": {
+			"dealerdirect/phpcodesniffer-composer-installer": true
+		}
+	}
+}