phpstan.neon

includes:
    - vendor/szepeviktor/phpstan-wordpress/extension.neon

parameters:
    level: 2
    # Some integration-specific ignoreErrors patterns may not match on every
    # installation or dependency version; that must not fail the gate itself.
    reportUnmatchedIgnoredErrors: false
    # Analyse the complete distributable PHP surface, but not the standalone
    # test programs. Those tests intentionally declare narrow WordPress
    # polyfills (for example add_action() with no parameters); including them
    # in the same PHPStan symbol table replaces the real WordPress signatures
    # supplied by phpstan-wordpress and produces hundreds of false positives.
    bootstrapFiles:
        - phpstan-bootstrap.php
    scanFiles:
        - tests/phpstan/optional-integrations.stub.php
    paths:
        - faz-cookie-manager.php
        - class-autoloader.php
        - index.php
        - uninstall.php
        - admin
        - frontend
        - includes
        - integrations
        - languages/index.php
        - public
    ignoreErrors:
        # External plugin functions/classes (optional integrations)
        - '#Function pll_default_language not found#'
        - '#Constant ICL_SITEPRESS_VERSION not found#'
        - '#Function wc_get_page_id not found#'
        # WP-CLI classes — only loaded when WP_CLI constant is defined
        - '#Call to static method .+ on an unknown class WP_CLI#'
        - '#Function WP_CLI.+not found#'
        # WordPress idiom: defensive isset()/empty() on $_GET / $_POST /
        # $_SERVER / $_COOKIE / $_REQUEST / $_FILES and unserialise() output
        # — superglobals always exist as arrays so PHPStan flags the
        # `isset($_GET['foo'])` pattern as "always defined". Scope the
        # suppression to those superglobals only; unrelated callsites still
        # benefit from the level-2 always-defined check.
        -
            message: '#Variable \$_(GET|POST|SERVER|COOKIE|REQUEST|FILES) in isset\(\) always exists and is not nullable#'
            path: '*'
        -
            message: '#Variable \$_(GET|POST|SERVER|COOKIE|REQUEST|FILES) in empty\(\) always exists and is not falsy#'
            path: '*'
        # szepeviktor/phpstan-wordpress ships an outdated stub for wp_json_encode
        # that declares only the $data param. The real WP signature is
        # wp_json_encode( mixed $data, int $options = 0, int $depth = 512 )
        # — see wp-includes/functions.php in WP 5.0+. Callsites that pass
        # JSON_PRETTY_PRINT / JSON_UNESCAPED_UNICODE / JSON_UNESCAPED_SLASHES
        # bitmasks are correct and must not be flagged.
        - '#Function wp_json_encode invoked with [23] parameters, 1 required#'
        # More szepeviktor/phpstan-wordpress stub-signature deficiencies — the
        # code is correct against the real WordPress signatures; only the bundled
        # stubs are wrong. Scoped to the specific functions so genuine
        # argument-count bugs elsewhere are still caught.
        #   - WP_Error::__construct( $code='', $message='', $data='' ): stub says 0-2.
        #   - apply_filters( $hook, $value, ...$args ) is variadic.
        #   - set_transient( $transient, $value, $expiration = 0 ): 3rd optional.
        #   - WP_Error::get_error_codes()/add()/… exist in core but not the stub.
        - '#Class WP_Error constructor invoked with 3 parameters, 0-2 required#'
        - '#Constructor of class WP_Error has an unused parameter \$(code|message|data)#'
        - '#Call to an undefined method WP_Error::(get_error_codes|add|get_error_messages|get_error_data|has_errors)\(\)#'
        - '#Function apply_filters invoked with [3-9] parameters, 2 required#'
        - '#Function set_transient invoked with 2 parameters, 3 required#'