Skip to content

v0.1.0 — Analyzer preview

Choose a tag to compare

View all tags
@SNO7E-G SNO7E-G released this 22 Jul 02:49
v0.1.0
553b183

Sediment v0.1.0 — Analyzer preview

The first public preview: a complete static analyzer for a WordPress plugin's
database footprint, from detection through grading and teardown generation. It
reads source only — no WordPress runtime, no database — and runs on PHP 8.3+.

What it does

  • Detection. Options (with the autoload flag), custom tables (dbDelta and
    CREATE TABLE via $wpdb->query, with $wpdb->prefix resolved to a
    {prefix} token), cron events (with recurrence), and transients.
  • Static resolution. Keys built from define()/const, class constants
    (self::, Foo::), $this-> properties, string concatenation, string
    interpolation, and local variables — each carrying an honest confidence level
    (verified, resolved, pattern, dynamic). It never presents a guess as a
    fact, and reports the fraction of write calls it could resolve.
  • Cleanup diff. Parses uninstall.php and register_uninstall_hook
    callbacks with the same engine and marks every artifact cleaned or left behind.
  • Grading. sediment grade returns an A–F letter and a 0–100 score weighted
    by real-world damage (an orphaned autoloaded option outweighs many small rows).
  • Generation. sediment uninstall writes a php -l-valid teardown that
    removes only the high-confidence, non-core artifacts a plugin leaves behind.
  • Safety. A WordPress core allowlist and a dedicated core-protection CI job
    assert that core artifacts can never enter a deletable set.

Install

composer require --dev sediment/analyzer
# or from a clone
git clone https://github.com/SNO7E-G/Sediment.git && cd Sediment && composer install

php bin/sediment scan path/to/plugin
php bin/sediment grade path/to/plugin
php bin/sediment uninstall path/to/plugin > uninstall.php

Full details are in the changelog.

Assets 2
Loading