fix(phpmd): narrow the UnusedFormalParameter exclusion to */lib/Migration/*

[rubenvdlinde]

The trap

*/Migration/* in phpmd-unusedparams.xml is a path-segment pattern, not a directory anchor. PDepend compiles an exclude-pattern into an unanchored regex — Input\ExcludePathFilter::__construct preg_quote()s the pattern and then turns \* into .*:

$this->relative = '(' . str_replace('\*', '.*', join('|', $quoted)) . ')i';

So */Migration/* matches any path containing a /Migration/ segment — lib/Service/Migration/, lib/Command/Migration/, any future lib/*/Migration/ — not just the app's IMigrationStep implementations. Those are ordinary classes with no interface-mandated signature, so a genuine unused parameter in one would never be reported and the run would still look clean.

Probe matrix — measured, not reasoned

PHPMD 2.15.0 / PHP 8.4.22 inside nextcloud:latest, three probe classes dropped onto a throwaway copy:

probe	*/Migration/*	*/lib/Migration/*
lib/Migration/… — UnusedFormalParameter	not reported	not reported (intended)
lib/Migration/… — ElseExpression (leg 1)	reported	reported (leg 1 unaffected)
lib/Service/… — UnusedFormalParameter	reported	reported
lib/Service/Migration/… — UnusedFormalParameter	NOT REPORTED	reported ← the leak

The IMigrationStep exclusion still does exactly its job: a step that cannot drop changeSchema / preSchemaChange / postSchemaChange's three mandated parameters is still spared, and leg 1 still analyses lib/Migration for every other rule.

Numbers: unchanged

A grep for /Migration/ directories outside lib/Migration/ found none in this repo, so nothing was actually being swallowed — as expected. Shipped findings and TRUE findings (measured with every @SuppressWarnings stripped on a throwaway copy) are identical before and after. The trap goes regardless, because the next lib/Service/Migration/ refactor would have walked straight into it.

One process note

The first draft of the explanatory comment contained a literal <- inside the <description>, which made the ruleset unparseable. PHPMD then exited 1 and reported nothing — and "no findings printed" is exactly what a clean run looks like to a grep. It was caught only by reading the exit code directly. The XML is validated as part of the check now.

No threshold changed, no rule removed, no baseline added (there is none, and there must not be — PHPMD auto-discovers phpmd.baseline.xml).

🤖 Generated with Claude Code

[github-actions]

Quality Report — ConductionNL/larpingapp @ e86917f

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-specs		✅
test-l10n		❌
composer			✅	✅ 101/101
npm			✅	✅ 537/537
PHPUnit					✅
Newman					❌
Playwright					❌
Hydra gates					❌

---

Quality workflow — 2026-08-05 15:47 UTC

Download the full PDF report from the workflow artifacts.