From d00612af9ab0b99ed3876af60516e925dc153d79 Mon Sep 17 00:00:00 2001
From: Ruben van der Linde <ruben@conduction.nl>
Date: Mon, 3 Aug 2026 10:19:50 +0200
Subject: [PATCH] fix(quality): phpmd DevelopmentCodeFragment could never fire
 on namespaced code

Every Conduction repo enables rulesets/design.xml/DevelopmentCodeFragment, and
it has never reported anything in any of them. The cause is a config gap, not a
phpmd bug: PDepend resolves an unqualified call inside a namespaced file to the
current-namespace-qualified image, so `var_dump($x)` written inside
`namespace OCA\MyApp\Service;` reaches the rule as
`OCA\MyApp\Service\var_dump` and never matches the `unwanted-functions` list.
All of our production PHP is namespaced, so with the default the rule is dead.

The rule's own `ignore-namespaces` property is the switch. This mirrors the
configuration already merged in openregister (ConductionNL/openregister#2286).

Proof, phpmd 2.15.0 / PHP 8.3.32, against this repo's own phpmd.xml:
  namespaced probe class calling var_dump()  -> exit 2, DevelopmentCodeFragment
  same class with the call removed           -> exit 0, no finding
Before the change the identical namespaced probe exited 0.

Blast radius on this repo: measured 0 new findings over the scanned path on
the base branch, with a per-run positive control (dropping the namespaced probe
into the same extracted tree does produce exit 2, so the zero is a true zero).
Nothing is baselined or suppressed here.

Also drops the `if [ -f vendor/bin/phpmd ]` wrapper from the composer script.
A file-presence guard that echoes and returns 0 is the same silent-pass defect
as the `|| echo ... skipping` it replaced, just in a new costume: a phpmd that
failed to install reads as a phpmd that found nothing. phpmd/phpmd is a
declared require-dev and the shared quality workflow runs
`composer install` before the gate, so removing the guard is a no-op whenever
the tool is present and a loud failure when it is not - which is the point.
The shared workflow already states this rule explicitly for its own
`require_script` check (ConductionNL/.github#121).
---
 composer.json |  2 +-
 phpmd.xml     | 27 ++++++++++++++++++++++++++-
 2 files changed, 27 insertions(+), 2 deletions(-)

diff --git a/composer.json b/composer.json
index 84bd3312..59d9df80 100644
--- a/composer.json
+++ b/composer.json
@@ -27,7 +27,7 @@
 		"phpcs": "./vendor/bin/phpcs --standard=phpcs.xml",
 		"phpcs:fix": "./vendor/bin/phpcbf --standard=phpcs.xml",
 		"phpcs:output": "./vendor/bin/phpcs --standard=phpcs.xml --report=json lib/ 2>/dev/null | tail -1 > phpcs-output.json",
-		"phpmd": "if [ -f vendor/bin/phpmd ]; then ./vendor/bin/phpmd lib text phpmd.xml --baseline-file phpmd.baseline.xml; else echo 'PHPMD not installed, skipping...'; fi",
+		"phpmd": "./vendor/bin/phpmd lib text phpmd.xml --baseline-file phpmd.baseline.xml",
 		"phpmetrics": "./vendor/bin/phpmetrics --report-html=phpmetrics lib/",
 		"phpmetrics:violations": "./vendor/bin/phpmetrics --violations-xml=phpmetrics/violations.xml lib/",
 		"psalm": "if [ -f vendor/bin/psalm ]; then ./vendor/bin/psalm --threads=1 --no-cache; else echo 'Psalm not installed, skipping...'; fi",
diff --git a/phpmd.xml b/phpmd.xml
index 149969b3..ee029854 100644
--- a/phpmd.xml
+++ b/phpmd.xml
@@ -48,7 +48,32 @@
     <rule ref="rulesets/design.xml/NumberOfChildren"/>
     <rule ref="rulesets/design.xml/DepthOfInheritance"/>
     <rule ref="rulesets/design.xml/CouplingBetweenObjects"/>
-    <rule ref="rulesets/design.xml/DevelopmentCodeFragment"/>
+    <!-- DevelopmentCodeFragment MUST carry ignore-namespaces=true, or it is dead
+         code in this ruleset. See ConductionNL/openregister#2286.
+
+         PDepend resolves an unqualified call inside a namespaced file to the
+         CURRENT-NAMESPACE-qualified image, so `var_dump($x)` in
+         `namespace OCA\MyApp\Service;` reaches the rule as
+         `OCA\MyApp\Service\var_dump`, which never matches the
+         `unwanted-functions` list. All of our production PHP is namespaced, so
+         with the default (false) the rule catches nothing anywhere.
+
+         Measured on phpmd 2.15.0 / PHP 8.3.32: byte-identical probe class,
+         namespaced -> exit 0, non-namespaced -> exit 2. With
+         ignore-namespaces=true the rule strips the enclosing namespace before
+         matching, the namespaced probe is reported (exit 2), and a clean
+         namespaced file stays exit 0.
+
+         Note: hydra gate 2 (forbidden-patterns) independently greps lib/ for
+         var_dump / die / error_log / print_r / dd / dump and is the broader
+         control - it also catches calls outside methods, which this rule (a
+         MethodAware/FunctionAware rule) cannot see. This rule is the
+         `composer check:strict` half of the same guard; keep both. -->
+    <rule ref="rulesets/design.xml/DevelopmentCodeFragment">
+        <properties>
+            <property name="ignore-namespaces" value="true"/>
+        </properties>
+    </rule>
     <rule ref="rulesets/design.xml/EmptyCatchBlock"/>
     <rule ref="rulesets/design.xml/CountInLoopExpression"/>