learniq/phpmd.xml at main · ConductionNL/learniq · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
<?xml version="1.0"?>
<ruleset name="learniq"
    xmlns="http://pmd.sourceforge.net/ruleset/2.0.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://pmd.sourceforge.net/ruleset/2.0.0 http://pmd.sourceforge.net/ruleset_xml_schema.xsd">
    <description>learniq — Conduction PHPMD ruleset (single source: conduction/hydra-gates).</description>

    <!-- Deviations from the central ruleset go BELOW this line, each with a
         reason. Everything else comes from conduction/hydra-gates. -->
    <rule ref="vendor/conduction/hydra-gates/quality-config/phpmd.xml">
        <exclude name="StaticAccess"/>
    </rule>

    <!-- StaticAccess: three exceptions, all named and all argued.

         (3) `\OCP\Server` is Nextcloud's service locator, reached from exactly
         one place here: `Support\FleetAppId::path()`. That method exists because
         the six call sites it serves hold their paths as class constants and
         none injects IAppManager; threading the dependency through six
         constructors, their DI wiring and their tests — for a lookup table that
         is scheduled for deletion — is not worth it. shillinq already carries
         `OCP\Server` as an audited exception for the same reason.

         The lookup is guarded: `\OCP\Server::get()` returns null with no
         container up, and an unguarded call there turns a resolvable path into
         a fatal.

         (2) `\OCA\Learniq\Support\FleetAppId` is a pure resolver over a constant
         map: given an IAppManager and a canonical app name, it returns whichever
         id the instance actually registered. It holds no state and no
         collaborators — it takes the only thing it needs as an argument — so
         there is nothing here that could be injected.

         It also exists to be DELETED. It bridges the window where `development`
         carries the new fleet app ids and `beta`/`main` still carry the old
         ones; once those agree, every call site becomes a plain string again and
         the class goes away. Its eight call sites in this app hold their paths
         as class constants and none injects IAppManager, so making it a service
         would mean threading a dependency through eight constructors, their DI
         wiring and their tests — to satisfy a rule about a lookup table that is
         scheduled for removal.

         (1) `\OCA\OpenRegister\AppHost\Bootstrap` exposes exactly ONE public member,
         `public static function register()`; its other seven methods are all
         `private static`. There is no instance API and no registerable service,
         so this is not a dependency that could be injected — it is a one-shot
         composition-root wiring call made from `Application::register()`.

         Fixing it "properly" would mean adding an instance API to OpenRegister
         and churning 20 call sites across 6 repos, to satisfy a rule that is
         measuring something which is not a design smell here.

         This uses the rule's OWN `exceptions` property — its designed
         configuration surface — rather than an @SuppressWarnings annotation or
         a baseline file. The distinction matters: the rule stays fully active
         for every other class, and the exception is one named class, visible in
         config, with the reason attached. Verified: with this exception in
         place, a probe using a DIFFERENT static call is still reported. -->
    <rule ref="rulesets/cleancode.xml/StaticAccess">
        <properties>
            <property name="exceptions" value="\OCA\OpenRegister\AppHost\Bootstrap,\OCA\Learniq\Support\FleetAppId,\OCP\Server"/>
        </properties>
    </rule>
</ruleset>