Add lint rule to enforce PHP deprecated-function detection

src/DDTrace/Integrations/Integration.php

@@ -60,16 +60,21 @@ public static function toString($value): string
             if (PHP_VERSION_ID >= 70200) {
                 $object_id = spl_object_id($value);
             } else {
+                // Unreachable on PHP >= 7.2 (see guard above); spl_object_hash() is only
+                // called here as a PHP < 7.2 polyfill for spl_object_id(), which does not
+                // exist before 7.2. Generic.PHP.DeprecatedFunctions cannot see the
+                // PHP_VERSION_ID guard, so the two calls below are scoped-suppressed
+                // rather than dropped, since they are still required on PHP 7.0/7.1.
                 static $object_base_hash;
                 if ($object_base_hash === null) {
                     ob_start();
                     $class = new \stdClass();
-                    $hash = spl_object_hash($class);
+                    $hash = spl_object_hash($class); // phpcs:ignore Generic.PHP.DeprecatedFunctions -- PHP < 7.2 only, see comment above
                     var_dump($class);
                     preg_match('(#\K\d+)', ob_get_clean(), $m);
                     $object_base_hash = hexdec(substr($hash, 0, 16)) ^ $m[0];
                 }
-                $object_id = $object_base_hash ^ hexdec(substr(spl_object_hash($value), 0, 16));
+                $object_id = $object_base_hash ^ hexdec(substr(spl_object_hash($value), 0, 16)); // phpcs:ignore Generic.PHP.DeprecatedFunctions -- PHP < 7.2 only, see comment above
             }
             return "object(" . get_class($value) . ")#$object_id";
         }

tooling/php-lint/README.md

@@ -48,11 +48,18 @@ fails:
 
 Enabled sniffs are version-agnostic safety checks (merge-conflict
 markers, BOM, LF line endings, final newline, no tabs, no trailing
-whitespace, open/close tags, backticks, `goto`, `FIXME`, `eval`).
-They are not a style guide.
-
-`TODO` comments, `php -l`, and deprecated-function detection stay
-commented in `phpcs.xml`. PSR-12 is off.
+whitespace, open/close tags, backticks, `goto`, `FIXME`, `eval`), plus
+`Generic.PHP.DeprecatedFunctions`, which flags calls to any function
+the PHP interpreter running phpcs reports as deprecated via
+`ReflectionFunction::isDeprecated()`. That one is not purely a style
+choice: it exists because reviewers repeatedly had to catch
+deprecated/version-incompatible function usage by hand (e.g.
+`spl_object_hash` on PHP 8.6, missing `PHP_VERSION_ID` guards). It does
+not parse the file with the runner's parser the way `Generic.PHP.Syntax`
+does, so it does not carry that sniff's cross-PHP-version risk.
+
+`TODO` comments and `php -l` stay commented out in `phpcs.xml`. PSR-12
+is off.
 
 Scope is first-party `src/` only. Generated bridge files and
 `tests/Frameworks/` are out of scope.

tooling/php-lint/phpcs.xml

@@ -41,6 +41,33 @@
     <rule ref="Squiz.WhiteSpace.SuperfluousWhitespace"/>
     <rule ref="Generic.WhiteSpace.DisallowTabIndent"/>
 
+    <!--
+        Enabled: recurring review-feedback theme, now mechanically enforced.
+
+        Over the trailing ~400 days of PR review activity, human reviewers
+        repeatedly had to flag calls to functions that are deprecated (or
+        outright unavailable) on some PHP version this repo still supports,
+        e.g.:
+          - "spl_object_hash is deprecated since PHP 8.6. You can simply
+            use spl_object_id." (Drupal integration)
+          - "Needs a PHP_VERSION_ID < 80000 check to avoid deprecations"
+            (Symfony integration)
+          - "this is php 7.4 syntax" (repo supports PHP 7.0+)
+          - "`const` was missing on the PHP 7.0 and 7.1 versions" (stub
+            signatures)
+        This class of feedback is exactly what Generic.PHP.DeprecatedFunctions
+        is built to catch mechanically: it walks the token stream for calls
+        to any function PHP itself reports as deprecated via
+        ReflectionFunction::isDeprecated() on the interpreter running phpcs
+        (the newest supported PHP in CI, see .gitlab/generate-common.php).
+        It does not parse the file with the runner's parser the way
+        Generic.PHP.Syntax does, so it carries none of that sniff's
+        cross-version syntax risk (see the note below). It was already
+        vetted as a zero-hit, low-risk candidate for src/ (see git history
+        of this file) — this change only turns it on.
+    -->
+    <rule ref="Generic.PHP.DeprecatedFunctions"/>
+
     <!--
         Close, but not a mechanical fix. Uncomment after the TODOs
         are resolved or dropped.
@@ -59,11 +86,6 @@
             runs php -l with the job's PHP. A file valid on 7.0 can fail
             on 8.x (and the reverse) without any source change.
 
-        Generic.PHP.DeprecatedFunctions
-            current src/ has no hits, but the sniff list grows with
-            PHPCS releases and tracks language deprecations.
-
         <rule ref="Generic.PHP.Syntax"/>
-        <rule ref="Generic.PHP.DeprecatedFunctions"/>
     -->
 </ruleset>