Code quality — GrumPHP gate

1. What runs and when

GrumPHP wires Git hooks that run automatically on git commit. Two hook stages:

pre-commit — runs against staged PHP/JSON files and fails the commit on any violation

• jsonlint — JSON files parse, no duplicate keys.
• laravel_pint — Laravel Pint auto-formats and re-stages.
• git_blacklist — blocks dd(, dump(, var_dump(, print_r(, die(, ray(.
• phpstan — PHPStan level 8 (with Larastan).
• phpcs — phpcs.xml rules (cyclomatic complexity ≤ 10, nesting depth ≤ 5).
• phpmnd — magic-number detector across app/.
• securitychecker_composeraudit — composer audit for dependency CVEs.
• pest — full test suite.

commit-msg — validates the message itself