Suppression & baseline audit: what the green PHPMD number hides

[rubenvdlinde]

Audit-only measurement of every suppression and baseline in this repo. Nothing was removed or changed — all numbers come from throwaway copies re-run in a container. Part of a 22-repo fleet sweep; see the summary issue for the fleet picture.

PHPMD: reported vs true

arm	violations	what it means
reported (composer phpmd as configured)	0	what CI prints today
baseline neutralised	0	+ what phpmd.baseline.xml hides
baseline + @SuppressWarnings neutralised	5	true current state

Delta: 0 → 5 (+5).

Baselines

file	entries	wiring
phpmd.baseline.xml	0	n/a
psalm-baseline.xml	0	n/a
phpstan-baseline.neon	0	n/a

Inline suppressions (lib/)

• @SuppressWarnings: 4 — 2 carry a written reason, 2 are bare.

Triage on whether a reason exists and still holds — not on the rule name.

⚠️ Inert <exclude-pattern> (config bug)

phpmd.xml nests 1 <exclude-pattern> inside a <rule> element. PHPMD only honours <exclude-pattern> as a direct child of <ruleset>, so this exemption has never applied.

Concretely: 3 UnusedFormalParameter findings sit in Migration/ — precisely what the pattern intends to exempt. openregister is the only repo whose pattern is a direct child, and it correctly shows 0 Migration hits. Moving the element up one level legitimately retires ~3 findings here.

Shared-template defect across 19 of 21 repos — fix once in the template.

Suggested burn-down order

1. Fix the exclude-pattern (above) — cheapest; retires interface-mandated noise legitimately.
2. Triage the 2 bare @SuppressWarnings — each gets a reason or goes.
3. Resolve orphan/undeclared baselines — they mislead without protecting.
4. Burn down the remainder by rule cluster, largest first.

Caveats measured, not assumed

• UndefinedVariable here is overwhelmingly false positives from by-ref out-params (preg_match($re,$s,$matches), openssl_*(output: $var)). The rule name is not a defect signal.
• Much UnusedFormalParameter mass is interface-mandated (Migration steps, listener signatures) and cannot be removed.

---

Audit only — no code, config or baseline modified. Measured on development in a fresh clone; PHP 8.4 / PHPMD 2.15.0; exit code checked on every run.