Pest v4 architecture testing php preset throws `Class "Spoofchecker" not found`

[paulshryock]

Summary

After upgrading to Pest 4.x, arch()->preset()->php() throws the following error:

Class "Spoofchecker" not found

Versions

php --version
PHP 8.4.11 (cli) (built: Aug  4 2025 20:47:15) (NTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.4.11, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.11, Copyright (c), by Zend Technologies

./vendor/bin/pest --version
Pest Testing Framework 4.0.4.

Test file

<?php

declare(strict_types=1);

describe('ensure we are not using side-effect or deprecated functions', fn() =>
  arch()->preset()->php());

Test output

FAILED  Tests\php\Architecture\ArchitectureTest > `ensure we are n…  Error   

Class "Spoofchecker" not found
at tests/php/Architecture/ArchitectureTest.php:6

  5▕ describe('ensure we are not using side-effect or deprecated functions', fn() =>
➜ 6▕  arch()->preset()->php());

1   tests/php/Architecture/ArchitectureTest.php:6

Tests:    1 failed, 0 passed (1 assertions)
Duration: 2.31s

Note

It "works on my machine", but the error is thrown when I run pest on the composer/composer:2.8 Docker image (which is based on the latest PHP 8 Alpine image, with Composer installed) in a continuous integration pipeline.

Before upgrading to Pest v4, this was never an issue.

What I've tried

composer require --dev ext-intl:^8.4
apk add icu-dev
docker-php-ext-configure intl
docker-php-ext-install intl
docker-php-ext-enable intl
composer install

[paulshryock]

I was able to resolve this in my continuous integration pipeline (running on the composer/composer:2.8 Docker image) by adding the following in the same pipeline step as Pest:

apk add icu-dev
docker-php-ext-configure intl
docker-php-ext-install intl
docker-php-ext-enable intl

That "works" and Pest is able to run successfully without throwing the error.

Altogether it adds an extra 1 minute and 18 seconds to each test run:

[paulshryock]

I ran composer require --dev ext-intl:^8.4 to require ext-intl as a dev dependency of my project, since ext-intl is a dependency of Pest in order to use Architecture testing with the php preset.

And in my pipeline step which runs composer install, that throws an error.

So to get that error fixed, I need to run these before composer install:

apk add icu-dev
docker-php-ext-configure intl
docker-php-ext-install intl
docker-php-ext-enable intl

And that means adding that extra 1 minute and 18 seconds in two places... making each pipeline run an extra 2 minutes and 36 seconds in total.

[paulshryock]

Ideally I would want to only install icu and intl once: in the composer install step, and then simply cache the PHP extensions directory as an artifact for re-use in later steps where I run Pest. (And I would ideally want to cache it between pipeline runs as well, so it's not re-installed on every run.)

I've tried caching the contents of the directory which is output when I run php-config --extension-dir, and that didn't work -- no files were cached between steps. I tried many different things to get the intl extension cached between steps and/or between runs, and was unsuccessful.

[paulshryock]

The exact place that SpoofChecker is used by Pest is in Pest\Expectations\OppositeExpectation\toHaveSuspiciousCharacters:

pest/src/Expectations/OppositeExpectation.php

Lines 287 to 296 in b740693

	$checker = new Spoofchecker;
	/** @var Expectation<array<int, string>|string> $original */
	$original = $this->original;
	return Targeted::make(
	$original,
	fn (ObjectDescription $object): bool => ! $checker->isSuspicious((string) file_get_contents($object->path)),
	'to not include suspicious characters',
	FileLineFinder::where(fn (string $line): bool => $checker->isSuspicious($line)),

[paulshryock]

I'm mainly sharing all this and documenting my findings here in case anyone else runs into the same issue and stumbles across this thread. Hope it's helpful.

[paulshryock]

Question for @nunomaduro: Should Pest declare ext-intl as an explicit dependency since it's required in order to use the SpoofChecker class used by Pest\Expectations\OppositeExpectation\toHaveSuspiciousCharacters?

Or would it be worth mentioning in the documentation for Architecture Testing that ext-intl is required in order to use that expectation or the php preset which uses it?

I've opened a pull request to update the documentation, if you think that is worth mentioning: pestphp/docs#340

[paulshryock]

I will close this now as there is likely no further action to take in Pest aside from the above proposed documentation changes, and maybe adding ext-intl as a dependency in composer.json, if that seems fitting (although some might consider that a breaking change which should have been included in v4 but now maybe needs to wait for v5 -- I don't know).

[paulshryock]

And that means adding that extra 1 minute and 18 seconds in two places... making each pipeline run an extra 2 minutes and 36 seconds in total.

In order to avoid adding 2.5 minutes to every continuous integration pipeline, I've decided to instead use the new skipOnCi method to avoid running the php Arch preset, and only run that preset locally before each commit.

<?php

declare(strict_types=1);

/**
 * It avoids the usage of die, var_dump, and similar functions, and ensures you
 * are not using deprecated PHP functions.
 *
 * @link https://pestphp.com/docs/arch-testing#content-php
 * @link https://github.com/pestphp/pest/blob/4.x/src/ArchPresets/Php.php
 *
 * As of Pest v4, the `php` preset runs the `not->toHaveSuspiciousCharacters()`
 * expectation, which requires the `intl` PHP extension. That is not installed
 * on the `composer/composer:2.8` Docker image, so we will skip this preset
 * during Continuous Integration, assuming engineers are running the tests
 * locally before each commit.
 *
 * @link https://pestphp.com/docs/pest-v4-is-here-now-with-browser-testing#content-skip-locally-or-on-ci
 */
describe('ensure we are not using side-effect or deprecated functions', fn() =>
  arch()->skipOnCi()->preset()->php()->ignoring('print'));

[troccoli-sgr]

Thank you for all your work @paulshryock

I think this new requirement is quite bad. It's not documented, at least not in the upgrade notes, and the example for the CI don't work any longer, because PHP in the composer:2 docker image does not have the intl extension (nor does the php:8.4 btw).

Manually installing as you did is unacceptable, to be honest, just because of the time it adds. I don't know which CI you use, but the pipelines in Bitbucket are already pretty slow, and I fear your workaround would add more than a couple of minutes.

Skipping the test in CI is also unacceptable, IMO. Sure, I run the tests every time, but I may forget and the CI is there exactly for that, so that tests are run every single time.

To reiterate, I'm not having a go at you @paulshryock. As I said, you did a lot for work investigating this issue and proposing workaround. I just hoe the team behind Pest would find a better solution.

[owenvoke]

Yeah, this is not ideal. 🤔 I'd say it makes sense to remove it from the defaults, and instead have it opt-in. We also likely want to have a better error when using it without the intl extension, other than just the class not being found.

For example, in toHaveSuspiciousCharacters() we could have a:

if (! class_exists(Spoofchecker::class)) {
    throw new MissingDependency(__FUNCTION__, 'ext-intl >= 2.0');
}

[paulshryock]

I'd say it makes sense to remove it from the defaults, and instead have it opt-in.

I really like that idea. It's a nice feature to have, but it technically requires a runtime dependency that not everyone has. So it's a shame for the entire preset to be "all or nothing".