Testing

This package provides a consistent set of Composer scripts for local validation.

Install the checkout dependencies with composer install --prefer-dist after following the installation guide. Foxy uses its native PHP manager for the published browser assets; the PHP checks require no Node.js build.

Tool references:

• Actionlint for GitHub Actions workflow linting.
• Codespell for spelling checks.
• Composer Require Checker for dependency definition checks.
• Easy Coding Standard (ECS) for coding standards.
• EditorConfig Checker for EditorConfig compliance.
• Gitleaks for secret scanning.
• Infection for mutation testing.
• Markdownlint-cli2 for Markdown linting.
• PHPStan for static analysis.
• PHPUnit for unit tests.
• Prettier for Markdown and YAML formatting checks.
• Yamllint for YAML linting.
• Zizmor for GitHub Actions security audits.

Coding standards (ECS)

Check coding standards without modifying files.

composer ecs-check

Apply coding standard fixes. Review the changes before keeping them.

composer ecs

Dependency definition check

Verify that runtime dependencies are correctly declared in composer.json.

composer check-dependencies

Mutation testing (Infection)

Run mutation testing.

composer mutation

Run mutation testing with PHPStan static analysis enabled.

composer mutation-static

Thresholds, thread count and memory options live in infection.json.dist. CI enforces the same thresholds.

Repository quality checks

Make the CLI tools used by the shared quality workflow available on PATH: actionlint with its ShellCheck helper, codespell, EditorConfig Checker, markdownlint-cli2, Prettier and yamllint. Run all checks:

composer quality

Each tool also has its own script:

composer actionlint
composer codespell
composer editorconfig-checker
composer markdownlint
composer prettier
composer yamllint

The linter configuration lives in .github/linters, and the Prettier configuration in .prettierrc.json and .prettierignore. CI uses the same files.

Static analysis (PHPStan)

Run static analysis.

composer static

Unit tests (PHPUnit)

Run the full test suite.

composer tests

Workflow security checks

Make zizmor and Gitleaks available on PATH. Audit the current workflow files with the same pedantic persona used by the shared security workflow:

composer zizmor

Scan Git history for secrets with the repository’s Gitleaks configuration:

composer gitleaks

Run both checks. Findings make the command fail; inspect them rather than disabling the checks.

composer security

Zizmor needs GitHub API access for its online audits. If the tool runs offline, report that limit separately. To request an offline audit explicitly:

composer zizmor -- --offline

Report hosted CI execution and its PHP/OS matrix separately from these local commands. Keep generated reports in ignored internal/.

Passing extra arguments

Composer scripts support forwarding additional arguments using --.

Run PHPUnit with code coverage report generation.

composer tests -- --coverage-html internal/coverage

Run PHPStan with a different memory limit.

composer static -- --memory-limit=512M

Browser and form flows

Exercise the forms in a consuming application with each supported Yii line and its selected manager. Check keyboard and mobile interaction, server validation, remote data, failure recovery and repeated initialization. Record the PHP, Yii and browser versions exercised.

The existing test and phpstan script names remain aliases of tests and static.

Back to documentation