Code Quality Audit

Run quality and security audits for Drupal and Next.js projects with consistent tooling and reporting.

Quick Commands

For direct access, use these commands:

• •/code-quality:setup - First-time setup wizard (install and configure tools)
• •/code-quality:audit - Run full audit (all 22 operations)
• •/code-quality:coverage - Check test coverage
• •/code-quality:security - Security scan (10 layers for Drupal, 7 for Next.js)
• •/code-quality:lint - Code standards check
• •/code-quality:solid - Architecture and SOLID principles check
• •/code-quality:dry - Find code duplication
• •/code-quality:tdd - Start TDD workflow (test watcher mode)

For conversational workflows, continue reading...

When to Use

Drupal projects:

• •"Setup quality tools" / "Install PHPStan"
• •"Run code audit" / "Check code quality"
• •"Check coverage" / "What's my coverage?"
• •"Find SOLID violations" / "Check complexity"
• •"Check duplication" / "DRY check"
• •"Lint code" / "Check coding standards"
• •"Fix deprecations" / "Run rector"
• •"Start TDD" / "RED-GREEN-REFACTOR"
• •"Check security" / "Find vulnerabilities" / "OWASP audit"

Next.js projects:

• •"Setup quality tools" / "Install ESLint"
• •"Run code audit" / "Check code quality"
• •"Check coverage" / "Run Jest coverage"
• •"Find SOLID violations" / "Check complexity" / "Check circular deps"
• •"Lint code" / "Run ESLint"
• •"Check duplication" / "DRY check"
• •"Start TDD" / "Jest watch mode"
• •"Check security" / "Find vulnerabilities" / "OWASP audit"

Quick Reference

Drupal Scripts

Next.js Scripts

Before Any Operation

Drupal:

1. •Locate Drupal root: check web/core/lib/Drupal.php or docroot/core/lib/Drupal.php
2. •Verify DDEV: ddev describe
3. •Create reports directory: mkdir -p .reports && echo ".reports/" >> .gitignore

Next.js:

1. •Verify npm: npm --version
2. •Create reports directory: mkdir -p .reports && echo ".reports/" >> .gitignore

When to Run What

Read decision-guides/quality-audit-checklist.md for detailed guidance.

Scope Targeting

To audit specific modules or components instead of the entire project:

See Scope Targeting for three approaches:

1. •Change directory (recommended) - cd web/modules/custom/my_module
2. •Environment variables - DRUPAL_MODULES_PATH=path/to/module
3. •Full scan (default) - Run from project root

Intelligent detection: Claude detects current directory and user intent.

Operations

All detailed operation instructions have been moved to reference files for better organization.

Drupal Operations

Setup & Configuration

• •Operation 1: Setup Tools - Install PHPStan, PHPMD, PHPCPD, Coder
• •Operation 6: Module-Specific Audit - Scope audit to one module
• •Operation 7: Add Composer Scripts - Configure quality scripts
• •Operation 8: CI Integration - Setup GitHub Actions

Quality Audits

• •Operation 2: Full Audit - Run all quality checks
• •Operation 3: Coverage Check - Measure test coverage
• •Operation 4: SOLID Check - Find principle violations
• •Operation 5: DRY Check - Detect code duplication
• •Operation 11: Lint Check - Coding standards
• •Operation 12: Rector Fix - Auto-fix deprecations

Development Workflows

• •Operation 10: TDD Workflow - RED-GREEN-REFACTOR cycle

Security

• •Operation 20: Security Audit - 10 security layers (v2.0.0)
  • •Drush pm:security, Composer audit
  • •yousha/php-security-linter, Psalm taint analysis
  • •Custom Drupal patterns, Security Review module
  • •Semgrep SAST, Trivy scanner, Gitleaks (v1.8.0)
  • •Roave Security Advisories (v2.0.0)

Next.js Operations

Setup & Configuration

• •Operation 13: Setup Tools - Install ESLint, Jest, security tools

Quality Audits

• •Operation 14: Full Audit - Run all quality checks
• •Operation 15: Lint Check - ESLint + TypeScript
• •Operation 16: Coverage Check - Jest coverage
• •Operation 17: DRY Check - Detect duplication
• •Operation 19: SOLID Check - Circular deps, complexity

Development Workflows

• •Operation 18: TDD Workflow - RED-GREEN-REFACTOR with Jest

Security

• •Operation 21: Security Audit - 7 security layers (v2.0.0)
  • •npm audit, ESLint security plugins
  • •Semgrep SAST, Trivy scanner, Gitleaks (v1.8.0)
  • •Custom React/Next.js patterns (XSS, eval, navigation)
  • •Socket CLI (v2.0.0)

Optional: DAST (Dynamic Testing)

Pre-production security testing for staging environments

• •Operation 22: DAST Tools - Dynamic security testing (v2.1.0)
  • •OWASP ZAP (full DAST scanner)
  • •Nuclei (template-based CVE scanning)
  • •Requires running application
  • •Use before releases on staging/pre-production

Saving Reports

All reports must follow schemas/audit-report.schema.json:

{
  "meta": {
    "project_type": "drupal|nextjs|monorepo",
    "timestamp": "2025-12-19T12:00:00Z",
    "thresholds": { "coverage_minimum": 70, "duplication_max": 5 }
  },
  "summary": {
    "overall_score": "pass|warning|fail",
    "coverage_score": "pass|warning|fail",
    "solid_score": "pass|warning|fail",
    "dry_score": "pass|warning|fail",
    "security_score": "pass|warning|fail"
  },
  "coverage": { "line_coverage": 75.5, "files_analyzed": 45 },
  "solid": { "violations": [] },
  "dry": { "duplication_percentage": 3.2, "clones": [] },
  "security": { "critical": 0, "high": 0, "medium": 3, "low": 5, "issues": [] },
  "recommendations": []
}

References

Core Guidance

• •references/tdd-workflow.md - RED-GREEN-REFACTOR patterns, test naming, cycle targets
• •references/coverage-metrics.md - Coverage targets by code type, PCOV vs Xdebug
• •references/dry-detection.md - Rule of Three, when duplication is OK
• •references/solid-detection.md - SOLID detection patterns and fixes
• •references/composer-scripts.md - Ready-to-use composer scripts
• •references/scope-targeting.md - Target specific modules/components (NEW in v1.8.0)

Operations

• •references/operations/drupal-setup.md - Drupal setup operations
• •references/operations/drupal-audits.md - Drupal quality audit operations
• •references/operations/drupal-security.md - Drupal security (10 layers, v2.0.0)
• •references/operations/drupal-tdd.md - Drupal TDD workflow
• •references/operations/nextjs-setup.md - Next.js setup operations
• •references/operations/nextjs-audits.md - Next.js quality audit operations
• •references/operations/nextjs-security.md - Next.js security (7 layers, v2.0.0)
• •references/operations/nextjs-tdd.md - Next.js TDD workflow

Online Dev-Guides (Drupal Domain)

For deeper Drupal-specific patterns beyond tool commands, WebFetch from https://camoa.github.io/dev-guides/. Use when explaining violations, suggesting fixes, or providing architectural context.

How to use: When analyzing violations or providing remediation guidance for Drupal projects, WebFetch the relevant topic URL (prefix with https://camoa.github.io/dev-guides/) to get comprehensive Drupal-specific patterns and examples.

Decision Guides

• •decision-guides/test-type-selection.md - Unit vs Kernel vs Functional decision tree
• •decision-guides/quality-audit-checklist.md - When to run what (pre-commit vs pre-merge)

Templates

Drupal

• •templates/drupal/phpstan.neon - PHPStan 2.x config (extensions auto-load)
• •templates/drupal/phpmd.xml - PHPMD ruleset for Drupal
• •templates/drupal/phpunit.xml - PHPUnit config with testsuites
• •templates/ci/github-drupal.yml - GitHub Actions workflow with security tools

Next.js

• •templates/nextjs/eslint.config.js - ESLint v9 flat config with TypeScript + security
• •templates/nextjs/jest.config.js - Jest config with coverage thresholds
• •templates/nextjs/jest.setup.js - Jest setup with Testing Library
• •templates/nextjs/.prettierrc - Prettier config with Tailwind plugin

What's New in v2.1.0

Phase 3 - Optional DAST Tools (NEW!):

• •✅ OWASP ZAP (full DAST scanner for pre-production)
• •✅ Nuclei (template-based CVE and misconfiguration scanning)
• •✅ Comprehensive documentation with usage examples
• •✅ CI/CD integration guides (GitHub Actions, GitLab)
• •✅ Pre-release checklist script

DAST Coverage:

• •Pre-production security testing
• •Runtime vulnerability detection
• •OWASP Top 10 dynamic testing
• •1000+ CVE templates (Nuclei)

See references/operations/dast-tools.md for full documentation.

What's New in v2.0.0

Progressive Disclosure Refactoring:

• •✅ SKILL.md: 632 → 234 lines (63% reduction)
• •✅ 9 reference files created with full documentation
• •✅ Plugin-creation-tools compliance (16/16 criteria)

Phase 1 - Cross-Stack Security Tools:

• •✅ Semgrep SAST (20,000+ security rules for PHP, React, JS, TS)
• •✅ Trivy scanner (dependency/container/secret scanner)
• •✅ Gitleaks (secret detection with 800+ patterns)

Phase 2 - Enhancement Tools:

• •✅ Roave Security Advisories (Drupal - Composer prevention layer)
• •✅ Socket CLI (Next.js - supply chain attack detection)

Security Coverage:

• •Drupal: 40% → 90% (10 security layers)
• •Next.js: 0% → 85% (7 security layers)

See .work-in-progress-v2.0.0.md for full implementation details.