PHP Language Support

Summary

Feature	Status	Notes
Maintainability	✔	Complexity, duplication, code smells
Linting	✔
Auto-formatting	✔
Custom checks	✔
Security scanning	✔	AppSec, dependencies, and secrets
Code metrics	✔
Code coverage	✔

Details

Maintainability
Complexity	✔	Aka cognitive complexity
Cyclomatic complexity	✔
Identical code duplication	✔
Similar code duplication	✔
Code smells	✔
Linters
PHP_CodeSniffer	✔
PHPStan	✔
radarlint-php	✔
Auto-formatters
php-cs-fixer	✔
Custom checks
ast-grep	✔
Semgrep	✔
ripgrep	✔
Security scanning
Gitleaks	✔	Secrets scanning
OSV-Scanner	✔	Dependency scanning (SCA)
radarlint-php	✔	AppSec (SAST)
Semgrep	✔	AppSec (SAST)
Trivy	✔	Dependency scanning (SCA)
TruffleHog	✔	Secrets scanning
Code coverage
PHPUnit	✔
Clover coverage format	✔
Cobertura coverage format	✔

File extensions

By default, PHP files are defined as:

[file_types.php]
globs = [
  "*.php",
  "*.ctp",
  "*.fcgi",
  "*.inc",
  "*.php3",
  "*.php4",
  "*.php5",
  "*.phps",
  "*.phpt",
  "*.phtml",
  "**/.php_cs",
  "**/.php_cs.dist",
  "**/Phakefile",
]

These patterns can be overridden from qlty.toml.

Supported PHP versions

We officially support PHP version 5 and later for maintainability checks and code coverage. Each plugin may have its own version requirements.