verify / php
Verifying PHP changes
Files: .php.
Run the checks under every change, add the checks for what your diff touches, then
apply the review prompts for what the tools miss. Usage is measured across
3 scanned repositories that write PHP; prompts come from
34 review discussions.
Run on every change
the tool most PHP repositories run for each check
-
Formatting Layout drift that buries the real change in the diff.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
Linting Bug-prone patterns, unused code and conventions the formatter does not cover.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
Type checking Wrong types, unhandled null or None, call signatures broken across modules.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
Unit and integration tests Behaviour regressions on the paths the tests exercise.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
Review prompts for every change 6 in total
Add when the change touches
open the ones that describe your diff
Authentication, input handling, secrets, permissions
-
Security scanning Injection, unsafe APIs and tainted data reaching a sink.
codeql33% · 1 of 3 reposruns via GitHub Action github/codeql-action/analyze
exit codes, docs, alternatives, where it runs
- Runs inci
- Alternatives
semgrep33% - Seen inappwrite/appwrite
- Docshttps://github.com/github/codeql
-
Secret scanning Credentials and tokens committed to the repository.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
Dependency audit Known-vulnerable or disallowed dependencies and licenses.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
Public APIs, signatures, error paths, nullability
-
Type checking Wrong types, unhandled null or None, call signatures broken across modules.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
Unit and integration tests Behaviour regressions on the paths the tests exercise.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
Property-based tests Edge-case inputs nobody wrote a test for; invariants over generated data.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
4 more in API, Error Handling, Null Handling — the playbook lists the top 9.
Service and framework code
-
Unit and integration tests Behaviour regressions on the paths the tests exercise.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
ci-matrix33% · 1 of 3 reposanalyze (language: 1)exit codes, docs, alternatives, where it runs
Algorithms, parsers, data transforms
-
Property-based tests Edge-case inputs nobody wrote a test for; invariants over generated data.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
Fuzzing Crashes, panics and hangs on malformed input, especially in parsers and decoders.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
Mutation testing Tests that keep passing whatever the code does.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
Proofs and specifications Design-level bugs in protocols and algorithms, checked against a specification.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
Threads, async code, locks, shared state
-
Concurrency model checking Races and orderings that fail only under specific interleavings.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
Undefined-behaviour detection Memory-safety and aliasing violations in unsafe code.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
Property-based tests Edge-case inputs nobody wrote a test for; invariants over generated data.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
Network calls, retries, timeouts, protocols
-
Unit and integration tests Behaviour regressions on the paths the tests exercise.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
Fuzzing Crashes, panics and hangs on malformed input, especially in parsers and decoders.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
UI components and pages
-
End-to-end browser tests User flows broken across components, routing and the network.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
Linting Bug-prone patterns, unused code and conventions the formatter does not cover.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
Databases, migrations, caching
-
Unit and integration tests Behaviour regressions on the paths the tests exercise.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
ci-matrix33% · 1 of 3 reposanalyze (language: 1)exit codes, docs, alternatives, where it runs
Hot paths and performance
No tool-based check applies. The review prompts below are the verification.
Model, prompt and LLM code
-
Unit and integration tests Behaviour regressions on the paths the tests exercise.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
CI workflows and configuration files
-
CI workflow linting Broken GitHub Actions syntax, script injection, over-broad token permissions.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
File hygiene Invalid JSON, YAML or TOML, merge markers, trailing whitespace, oversized files.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
Dependencies and lockfiles
-
Dependency audit Known-vulnerable or disallowed dependencies and licenses.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
Lockfile consistency A lockfile that no longer matches its manifest.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
ci-matrix33% · 1 of 3 reposanalyze (language: 1)exit codes, docs, alternatives, where it runs
The tests themselves
-
Mutation testing Tests that keep passing whatever the code does.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
ci-matrix33% · 1 of 3 reposanalyze (language: 1)exit codes, docs, alternatives, where it runs
Documentation and comments
-
Docs build Broken cross-references, links and markup in documentation.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
-
Spelling Typos in identifiers, comments and docs.
No scanned repository in this language runs a tool for this. Lean on the review prompts.
Where this comes from
3 scanned repositories with at least a fifth of their prompts in PHP
appwrite/appwrite7 · laravel/framework0 · getsentry/sentry-php0