Code reviews are a regular part of our project process and give us the opportunity to catch bugs and standardize code before work is tested by our project leads or clients. You can read more about our code review philosophy in our last post.
This post aims to give an overview of some of the code review tools we use for PHP code reviews.
For smaller reviews, using Git history to look at a code change is all you need. We use a post-commit Git hook that posts commit hashes to their related tickets in our project management software, so when you’re assigned a ticket to review, you can easily see the commit IDs and run “
git show [the hash]” to see the change. With some other ticket management tools you may even be able to see the code changes right along with the ticket comments.
The PHP CodeSniffer (PHPCS) utility reviews PHP code for adherence to a given code standard. For Drupal projects, we can check code against Drupal’s standards. There are a few ways to run this, but first, you’ll need to install a few things.
How to install PHP CodeSniffer
- Download the PHPCS package using Composer.
- For Drupal 7 projects:
composer global require squizlabs/PHP_CodeSniffer:\<2
- For Drupal 8 projects:
composer global require squizlabs/PHP_CodeSniffer:\>=2
- Or, you can install PHPCS with Drush.
- For Drupal 7 projects:
- Download the Drupal Coder module (7.x-2.x branch – this part is important, don’t choose the 1.x branch). Move this to your central Drush directory (
$HOME/.drush) – that allows it to be used on all your Drupal projects.
- Configure PHPCS to use Drupal standards:
phpcs --config-set installed_paths $HOME/.drush/coder/coder_sniffer
phpcs --config-set default_standard Drupal
Run PHP CodeSniffer in phpStorm IDE
If you use an IDE, there’s probably a plugin for running PHPCS. I set it up in phpStorm like this:
- Follow the directions above to install CodeSniffer with the Drupal standards.
- Set the path to your CodeSniffer installation in phpStorm (Preferences > Languages & Frameworks > PHP > CodeSniffer). Click the Validate button there to make sure it works.
- Enable CodeSniffer (Preferences > Editor > Inspections): Select “PHP CodeSniffer validation”, then select Drupal as the standard to use.
Once that’s hooked up, you’ll start to see inline alerts of your rule breaking. You can also run PHPCS against a whole file, directory or project (Code > Run inspection by name > PHPCS). This will give you a list of all the issues PHPCS finds, with a synopsis of the problem and how to fix it.
There are a lot more Drupal-specific features in phpStorm that are worth trying out, especially in Drupal 8 – check out the JetBrains site for more information.
Run CodeSniffer on the command line
If you don’t use an IDE or just prefer a CLI, you can run PHPCS with terminal commands. You can do this with Drush, like this:
drush drupalcs path/to/your/file
Or, without Drush, like this:
phpcs --standard=Drupal path/to/your/file
The command will return a list of errors and the line numbers where they occur.
Drupal Coder Review module
If you prefer a UI, you can still make use of the Coder module by way of the accompanying Coder Review module.
- Download the Coder module to your site’s module directory and enable coder and coder_review.
- Browse to admin/config/development/coder/settings.
- Choose which modules or themes to review.
- Review your results, and if needed, make the suggested changes to your code.
Best practices for Drupal code are well-documented on Drupal.org:
- Coding standards: https://www.drupal.org/coding-standards
- Writing secure code: https://www.drupal.org/writing-secure-code
- Accessibility best practices: https://www.drupal.org/node/1637990
These are some other blog posts on the topic:
- A Quick Guide for Code Reviews | Lullabot
- How to review Drupal code | Colan Schwartz
- Enforcing Drupal Coding Standards During the Software Versioning Process
- Tools for Automating Coding Standards Reviews
Do you use any other code review tools?
How do you use code review tools in your project process?