>>> [!note] Migrated issue <!-- Drupal.org comment --> <!-- Migrated from issue #3599835. --> Reported by: [pfrenssen](https://www.drupal.org/user/382067) Related to !81 >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> <p>Tests in this module should build their webforms from <strong>exported configuration fixtures</strong> (under <code>tests/modules/graphql_webform_test/config/install/</code>), not by creating webform entities programmatically &mdash; neither <code>Webform::create([...])</code> nor <code>$storage-&gt;create([...])</code> from the entity type manager. This is a convention the maintainers follow, but nothing documents or enforces it, so a contributor (or an AI assistant) can reintroduce programmatic webform creation and have it pass review by accident.</p> <p>Exported fixtures are strongly preferred over inline creation for three reasons:</p> <ul> <li><strong>They are runnable documentation.</strong> An exported webform can be imported into a real Drupal site and tried by hand, exactly as a site builder would use it.</li> <li><strong>They are a reference for frontend implementers.</strong> The exported test form showcases every element type the GraphQL API covers, so a developer building a matching frontend that consumes the API has a concrete, complete example to implement each form element against.</li> <li><strong>They survive Webform schema changes.</strong> When Webform's config schema changes, a single exported file is updated, rather than many copies of the same YAML hand-inlined across PHP test files.</li> </ul> <p>Programmatically created webforms defeat all three: the ad-hoc form is invisible to a site builder and to frontend implementers, and it drifts from the exported fixtures as Webform evolves.</p> <h3 id="summary-proposed-resolution">Proposed resolution</h3> <p>Add a small custom PHP_CodeSniffer sniff that forbids creating webform entities programmatically in test code, and wire it into the module's coding-standards run so it fails CI like any other sniff.</p> <ul> <li>Add a local sniff (e.g. <code>GraphQLWebform/Sniffs/Testing/NoProgrammaticWebformCreationSniff.php</code>) that reports an error on the ways a webform entity gets created in code: <ul> <li>a static <code>create()</code> call on the <code>Webform</code> entity class &mdash; both the imported short name <code>Webform::create()</code> and the fully-qualified <code>\Drupal\webform\Entity\Webform::create()</code>;</li> <li>a <code>create()</code> call on the webform entity storage, i.e. <code>-&gt;getStorage('webform')-&gt;create(...)</code> (the obvious next thing a developer reaches for once <code>Webform::create()</code> is blocked).</li> </ul> </li> <li>Add a local ruleset that registers the sniff's namespace, and reference it from <code>phpcs.xml</code> scoped to the test paths (<code>tests/</code>), so production code is unaffected.</li> <li><strong>Make the error message prescriptive, not just prohibitive.</strong> It must tell the developer exactly what to do instead, so they do not simply swap one creation mechanism for another. Something like: <em>"Do not create webforms programmatically in tests. Add or extend an exported webform config fixture under <code>tests/modules/graphql_webform_test/config/install/</code> and install it; the exported config doubles as documentation and as a reference for frontend implementers."</em></li> <li>Document the convention in <code>AGENTS.md</code> under "Test conventions", so the sniff and the prose agree.</li> <li>Cover the sniff with its own fixture-based test so the detection logic is verifiable.</li> </ul> <h3 id="summary-remaining-tasks">Remaining tasks</h3> <ul> <li>Add the sniff class (covering <code>Webform::create()</code> and <code>-&gt;getStorage('webform')-&gt;create()</code>) and its local ruleset/standard, with a prescriptive error message.</li> <li>Reference the local standard from <code>phpcs.xml</code>, scoped to <code>tests/</code>.</li> <li>Document the convention in <code>AGENTS.md</code> "Test conventions".</li> <li>Add a sniff test (fixture + expected error map).</li> <li>Verify <code>ddev phpcs</code> still passes on the current tree (no programmatic webform creation remains in tests) and that the sniff fires on a deliberate violation.</li> </ul> <h3 id="summary-release-notes">Release notes snippet</h3> <p>Contributor tooling: a coding-standards check now forbids creating webforms programmatically in tests, enforcing that test webforms are built from exported configuration fixtures.</p>