PHP ≥ 8.1; the version floor in composer.json and the CI image must
match. Style PER-CS; autoloading PSR-4 with namespaces mirroring
directories. Composer for dependencies; private packages via VCS repos
on the org git host. Framework preference: Symfony (components or
full). Dependency injection: symfony/dependency-injection or PHP-DI.
app/configs/<vhost>.php per-vhost config; hosts/ subdir for per-node
overrides; *local.php variants gitignored
(env-specific values)
app/src/ PSR-4 code: Components/ Controllers/ Services/
Models/ …
bin/ console & cron scripts (umask(0002))
daemons/ long-running workers (if any)
config/ Symfony bundle/route/package config
(full-framework apps only)
migrations/ DB migrations (.js for Mongo incl. index setup,
.sql for MySQL), named after the issue
public/ web root: index.php (umask(0002)), css/ js/ img/
tests/ Codeception suites: unit/ functional/ api/
acceptance/ (+ load/ where relevant)
vendor/ composer-managed, never hand-edited
Application logs go to /var/log/php-applications/<app>.log (absolute
path, never relative).
src/ the package (PSR-4)
tests/ PHPUnit (or the project's established runner)
public/ optional demo/tool UI
osi/lib-common (on the org git host, PSR-4 osi\libCommon\) is the
company-wide PHP foundation. Prefer it over ad-hoc code or new
third-party packages for anything it already covers:
- Configuration, Log, StatusMonitor/syschecks, Db/DocumentDB (incl. the Mongo wire driver), Paginator, Tool
- Connectors/ConnectorManager, Guzzle handlers, curl/request helpers
- Domain helpers: AdTech, SSP, Cookie, Serialize, GeoIP/region codes, device detection
- SymfonyCacheAdapter, TestsSupport (Codeception support), frontend helpers
Adding a third-party package for a capability lib-common provides needs the same sign-off as any new dependency; improvements go into lib-common itself so every app benefits.
- phpstan level 7+ as a required CI job. A
phpstan-baseline.neonmay grandfather pre-existing errors; the baseline only shrinks - new code never adds to it. - CI runs phpstan and the test suite. Dev-tools that are declared but never run in CI are either wired in or removed.
- Emit phpstan results in the CI code-quality report format so findings appear inline in MRs.
- All tooling on maintained major versions (Codeception, phpstan).
- Metrics client: slickdeals/statsd.
- Packages that are abandoned or floor on an EOL PHP are replacement
candidates - check
composer outdatedand composer's abandoned-package warnings during maintenance branches.