ruleset.xml

<?xml version="1.0"?>
<ruleset name="10up-Default">
	<description>A base ruleset that all other 10up rulesets should extend.</description>

	<exclude-pattern>*/phpunit.xml*</exclude-pattern>
	<exclude-pattern>*/dist/*</exclude-pattern>
	<exclude-pattern>*/languages/*</exclude-pattern>

	<!-- Third-party code -->
	<exclude-pattern>*/bower-components/*</exclude-pattern>
	<exclude-pattern>*/node_modules/*</exclude-pattern>
	<exclude-pattern>*/vendor/*</exclude-pattern>

	<!-- Ensure certain file types aren't sniffed -->
	<exclude-pattern>*\.(css|js)</exclude-pattern>

	<!-- Don't worry about files that don't contain any code -->
	<rule ref="Internal.NoCodeFound">
		<severity>0</severity>
	</rule>

	<!-- Ignore mixed line-endings warnings -->
	<rule ref="Internal.LineEndings.Mixed">
		<severity>0</severity>
	</rule>

	<!-- Internal exceptions (often occur on minified files) -->
	<rule ref="Internal.Tokenizer.Exception">
		<severity>0</severity>
	</rule>

	<!-- For CI, don't fail on warnings -->
	<config name="ignore_warnings_on_exit" value="1"/>

	<rule ref="WordPress.DB.PreparedSQL"/>
	<rule ref="WordPress.DB.DirectDatabaseQuery"/>
	<rule ref="WordPress.DB.SlowDBQuery"/>
	<rule ref="WordPress.WP.PostsPerPage">
		<properties>
			<property name="posts_per_page" value="200"/>
		</properties>
	</rule>
	<!-- Enforce doc standards -->
	<rule ref="WordPress-Docs">
		<!-- Don't worry about capitalizing long lines -->
		<exclude name="Generic.Commenting.DocComment.LongNotCapital"/>

		<!-- Dont need to capitalize first letter -->
		<exclude name="Generic.Commenting.DocComment.ShortNotCapital"/>
	</rule>

	<rule ref="WordPress-Extra">
		<!-- Undeprecated in WordPress 5.9.0 -->
		<exclude name="WordPress.WP.DeprecatedFunctions.sanitize_urlFound" />

		<!-- Forget about file names -->
		<exclude name="WordPress.Files.FileName"/>

		<!-- Allow same line control structures e.g. if ( true ) { echo 1; } -->
		<exclude name="Squiz.ControlStructures.ControlSignature.NewlineAfterOpenBrace"/>

		<!-- Don't require punctuation after inline comments -->
		<exclude name="Squiz.Commenting.InlineComment.InvalidEndChar"/>

		<!-- Allow empty catch statements -->
		<exclude name="Generic.CodeAnalysis.EmptyStatement.DetectedCatch"/>

		<!-- Comment punctuation doesn't matter -->
		<exclude name="Squiz.Commenting.FunctionComment.ParamCommentFullStop"/>
		<exclude name="Squiz.Commenting.FunctionComment.ThrowsNoFullStop"/>

		<!-- Allow shorthand array syntax -->
		<exclude name="Generic.Arrays.DisallowShortArraySyntax.Found"/>

		<!-- Allow WP global modification -->
		<exclude name="WordPress.WP.GlobalVariablesOverride.Prohibited"/>

		<!-- This nonce sniff almost never works right -->
		<exclude name="WordPress.Security.NonceVerification.Missing"/>
	</rule>

	<!-- Sets the minimum supported WP version to 4.7, which is over a year old. -->
	<config name="minimum_supported_wp_version" value="4.7" />

	<!-- Make missing translator comment a warning. -->
	<rule ref="WordPress.WP.I18n.MissingTranslatorsComment">
		<type>warning</type>
	</rule>

	<!-- Sometimes we need to override globals -->
	<rule ref="WordPress.WP.GlobalVariablesOverride.OverrideProhibited">
		<type>warning</type>
	</rule>

	<!-- Make sure we always exit after a redirect -->
	<rule ref="WordPressVIPMinimum.Security.ExitAfterRedirect"/>

	<!-- Make sure that the proper escaping functions are being used -->
	<rule ref="WordPressVIPMinimum.Security.ProperEscapingFunction"/>

	<!-- Validate sanitised input. -->
	<rule ref="WordPress.Security.ValidatedSanitizedInput">
		<properties>
			<property name="customSanitizingFunctions" type="array">
				<!-- sanitize_url() is an undeprecated sanitizing function. -->
				<element value="sanitize_url" />
			</property>
		</properties>
	</rule>

	<!-- Loads the PHP Compatibility ruleset. -->
	<rule ref="PHPCompatibilityWP" />

	<!-- PHP version check. -->
	<config name="testVersion" value="8.1-"/>
</ruleset>