How to add additional Coding Standards to php-codesniffer and other PHP tools

[jacobsantos]

Question

I am trying to use slevomat/coding-standard with php-codesniffer library. I get the following error when I run the qlty check command locally:

ERROR: Referenced sniff "SlevomatCodingStandard.Namespaces.UnusedUses" does not exist

This also occurs with other PHP tools where there might be additional vendor dependencies. I tried using extra_packages. The problem is that some code exists in the same repository and the config sandbox is not picking up the files. Using relative paths also does not work.

includes:
    - vendor/larastan/larastan/extension.neon

With PHPStan to include Laravel extensions does not work.

I tried symlinking the files in the .qlty/configs directory, but that was also a no-go.

What am I doing wrong and what can I do to allow these tools to work with custom or third-party extensions?

How to reproduce (optional)

1. Using phpcs.xml configuration

   <?xml version="1.0"?>
   <ruleset name="Laravel PHPCS Ruleset">
       <description>PHPCS ruleset based on PHP-CS-Fixer configuration for Laravel</description>
   
       <!-- Files to check -->
       <file>app</file>
       <file>config</file>
       <file>database</file>
       <file>routes</file>
       <file>src</file>
       <file>tests</file>
   
       <!-- Exclude patterns -->
       <exclude-pattern>bootstrap/cache</exclude-pattern>
       <exclude-pattern>storage</exclude-pattern>
       <exclude-pattern>vendor</exclude-pattern>
       <exclude-pattern>node_modules</exclude-pattern>
       <exclude-pattern>public</exclude-pattern>
       <exclude-pattern>resources/views</exclude-pattern>
       <exclude-pattern>*.blade.php</exclude-pattern>
       <exclude-pattern>_ide_helper.php</exclude-pattern>
       <exclude-pattern>_ide_helper_models.php</exclude-pattern>
   
       <!-- Arguments -->
       <arg name="colors"/>
       <arg value="spv"/>
       <arg name="extensions" value="php"/>
   
       <!-- Base ruleset -->
       <rule ref="PSR12"/>
   
       <!-- Array syntax -->
       <rule ref="Generic.Arrays.DisallowLongArraySyntax"/>
   
       <!-- Strict types -->
       <rule ref="Generic.PHP.RequireStrictTypes"/>
   
       <!-- Unused imports -->
       <rule ref="SlevomatCodingStandard.Namespaces.UnusedUses">
           <properties>
               <property name="searchAnnotations" value="true"/>
           </properties>
       </rule>
   
       <!-- Import ordering -->
       <rule ref="SlevomatCodingStandard.Namespaces.AlphabeticallySortedUses"/>
   
       <!-- No leading slash in imports -->
       <rule ref="SlevomatCodingStandard.Namespaces.UseDoesNotStartWithBackslash"/>
   
       <!-- Single line after imports -->
       <rule ref="SlevomatCodingStandard.Namespaces.RequireOneNamespaceInFile"/>
   
       <!-- Class attributes separation -->
       <rule ref="Squiz.WhiteSpace.FunctionSpacing">
           <properties>
               <property name="spacing" value="1"/>
               <property name="spacingBeforeFirst" value="0"/>
               <property name="spacingAfterLast" value="0"/>
           </properties>
       </rule>
   
       <!-- Concatenation spacing -->
       <rule ref="Squiz.Strings.ConcatenationSpacing">
           <properties>
               <property name="spacing" value="1"/>
               <property name="ignoreNewlines" value="true"/>
           </properties>
       </rule>
   
       <!-- Single quotes -->
       <rule ref="Squiz.Strings.DoubleQuoteUsage">
           <exclude name="Squiz.Strings.DoubleQuoteUsage.ContainsVar"/>
       </rule>
   
       <!-- No PHP4 constructors -->
       <rule ref="Generic.NamingConventions.ConstructorName"/>
   
       <!-- Indentation -->
       <rule ref="Generic.WhiteSpace.ScopeIndent">
           <properties>
               <property name="indent" value="4"/>
               <property name="tabIndent" value="false"/>
           </properties>
       </rule>
   
       <!-- No trailing whitespace -->
       <rule ref="Squiz.WhiteSpace.SuperfluousWhitespace">
           <properties>
               <property name="ignoreBlankLines" value="false"/>
           </properties>
       </rule>
   
       <!-- Blank line at end of file -->
       <rule ref="Generic.Files.EndFileNewline"/>
   
       <!-- Object operator without whitespace -->
       <rule ref="Squiz.WhiteSpace.ObjectOperatorSpacing">
           <properties>
               <property name="ignoreNewlines" value="true"/>
           </properties>
       </rule>
   
       <!-- No spaces inside parenthesis -->
       <rule ref="Generic.WhiteSpace.ArbitraryParenthesesSpacing">
           <properties>
               <property name="spacing" value="0"/>
           </properties>
       </rule>
   
       <!-- Ternary operator spaces -->
       <rule ref="Squiz.WhiteSpace.OperatorSpacing">
           <properties>
               <property name="ignoreNewlines" value="true"/>
           </properties>
       </rule>
   
       <!-- PHPDoc standards -->
       <rule ref="Squiz.Commenting.FunctionComment">
           <exclude name="Squiz.Commenting.FunctionComment.SpacingAfterParamType"/>
           <exclude name="Squiz.Commenting.FunctionComment.InvalidReturn"/>
           <exclude name="Squiz.Commenting.FunctionComment.IncorrectParamVarName"/>
           <exclude name="Squiz.Commenting.FunctionComment.MissingParamComment"/>
           <exclude name="Squiz.Commenting.FunctionComment.Missing"/>
       </rule>
   
       <!-- No empty PHPDoc -->
       <rule ref="SlevomatCodingStandard.Commenting.EmptyComment"/>
   
       <!-- Type hints -->
       <rule ref="SlevomatCodingStandard.TypeHints.ReturnTypeHintSpacing"/>
       <rule ref="SlevomatCodingStandard.TypeHints.ParameterTypeHintSpacing"/>
   
       <!-- Laravel specific rules -->
       <rule ref="SlevomatCodingStandard.Classes.ClassConstantVisibility"/>
       <rule ref="SlevomatCodingStandard.Classes.PropertySpacing"/>
   
       <!-- Namespace formatting -->
       <rule ref="SlevomatCodingStandard.Namespaces.NamespaceDeclaration"/>
       <rule ref="SlevomatCodingStandard.Namespaces.NamespaceSpacing"/>
   
       <!-- No unnecessary parentheses -->
       <rule ref="SlevomatCodingStandard.PHP.UselessParentheses"/>
   
       <!-- Strict comparison -->
       <rule ref="SlevomatCodingStandard.Operators.RequireOnlyStandaloneIncrementAndDecrementOperators"/>
   
       <!-- Type casting -->
       <rule ref="Generic.Formatting.SpaceAfterCast"/>
       <rule ref="Squiz.WhiteSpace.CastSpacing"/>
   
       <!-- Control structure spacing -->
       <rule ref="Squiz.ControlStructures.ControlSignature"/>
       <rule ref="Squiz.WhiteSpace.ControlStructureSpacing"/>
   
       <!-- Custom configuration for Laravel patterns -->
       <rule ref="SlevomatCodingStandard.Classes.ModernClassNameReference"/>
       <rule ref="SlevomatCodingStandard.Exceptions.DeadCatch"/>
       <rule ref="SlevomatCodingStandard.Functions.UnusedInheritedVariablePassedToClosure"/>
       <rule ref="SlevomatCodingStandard.Variables.UnusedVariable"/>
   
       <!-- Disable some rules that conflict with Laravel conventions -->
       <rule ref="PSR1.Classes.ClassDeclaration.MissingNamespace">
           <exclude-pattern>database/migrations/*</exclude-pattern>
           <exclude-pattern>database/seeders/*</exclude-pattern>
       </rule>
   
       <!-- Allow snake_case for database-related files -->
       <rule ref="Squiz.NamingConventions.ValidFunctionName.ScopeNotCamelCaps">
           <exclude-pattern>database/*</exclude-pattern>
           <exclude-pattern>tests/*</exclude-pattern>
       </rule>
   
       <!-- Laravel test method naming -->
       <rule ref="PSR1.Methods.CamelCapsMethodName.NotCamelCaps">
           <exclude-pattern>tests/*</exclude-pattern>
       </rule>
   </ruleset>

2. Run vendor/bin/phpcs src
3. Run qlty check

Expected behavior (optional)

qlty check should complete and show the same sniff failures as vendor/bin/phpcs src

CLI Version

qlty 0.557.0 macos-arm64 (5904892 2025-07-22)

Information about Qlty configuration and environment (optional)

# This file was automatically generated by `qlty init`.
# You can modify it to suit your needs.
# We recommend you to commit this file to your repository.
#
# This configuration is used by both Qlty CLI and Qlty Cloud.
#
#     Qlty CLI -- Code quality toolkit for developers
#     Qlty Cloud -- Fully automated Code Health Platform
#
# Try Qlty Cloud: https://qlty.sh
#
# For a guide to configuration, visit https://qlty.sh/d/config
# Or for a full reference, visit https://qlty.sh/d/qlty-toml
config_version = "0"

exclude_patterns = [
  "*_min.*",
  "*-min.*",
  "*.min.*",
  "**/.yarn/**",
  "**/*.d.ts",
  "**/assets/**",
  "**/bower_components/**",
  "**/build/**",
  "**/cache/**",
  "**/config/**",
  "**/db/**",
  "**/deps/**",
  "**/dist/**",
  "**/extern/**",
  "**/external/**",
  "**/generated/**",
  "**/Godeps/**",
  "**/gradlew/**",
  "**/mvnw/**",
  "**/node_modules/**",
  "**/protos/**",
  "**/seed/**",
  "**/target/**",
  "**/templates/**",
  "**/testdata/**",
  "**/vendor/**",
]

test_patterns = [
  "**/test/**",
  "**/spec/**",
  "**/*.test.*",
  "**/*.spec.*",
  "**/*_test.*",
  "**/*_spec.*",
  "**/test_*.*",
  "**/spec_*.*",
]

[smells]
mode = "comment"

[[source]]
name = "default"
default = true


[[plugin]]
name = "actionlint"

[[plugin]]
name = "checkov"

[[plugin]]
name = "eslint"
version = "8.57.1"
package_file = "package.json"
package_filters = ["eslint", "prettier"]

[[plugin]]
name = "markdownlint"
mode = "comment"

[[plugin]]
name = "osv-scanner"

[[plugin]]
name = "php-codesniffer"
mode = "comment"
extra_packages = [
    "slevomat/coding-standard@^8.0"
]

[[plugin]]
name = "php-cs-fixer"

[[plugin]]
name = "phpstan"

[[plugin]]
name = "prettier"
version = "3.5.3"
package_file = "package.json"
package_filters = ["prettier"]

[[plugin]]
name = "radarlint-js"

[[plugin]]
name = "radarlint-php"
mode = "comment"

[[plugin]]
name = "ripgrep"
mode = "comment"

[[plugin]]
name = "trivy"
drivers = [
  "config",
  "fs-vuln",
]

[[plugin]]
name = "trufflehog"

[[plugin]]
name = "yamllint"

• OS: macOS (15.5 (24F74))

[jacobsantos]

I looked at https://github.com/orgs/qltysh/discussions/1499 and it does not resolve the issue. Adding the composer.json to the qlty.toml file does not bring the dependency.

Snippet from .qlty/qlty.toml

[[plugin]]
name = "php-codesniffer"
mode = "comment"
package_file = ".qlty/configs/composer.json"

.qlty/configs/composer.json

{
    "require": {
        "slevomat/coding-standard": "~8.0",
        "larastan/larastan": "^2.0"
    },
    "config": {
        "sort-packages": true,
        "allow-plugins": {
            "dealerdirect/phpcodesniffer-composer-installer": true
        }
    }
}

qlty check --filter=php-codesniffer --no-cache --no-fix --debug --verbose --all with version qlty 0.558.0 macos-arm64 (b0a3def 2025-07-27) still returns ERROR: Referenced sniff "SlevomatCodingStandard.Namespaces.UnusedUses" does not exist.

[jacobsantos]

Problem continues to exist in qlty 0.563.0 macos-arm64 (b25263c 2025-08-06)