padosoft-laravel-conventionslisted

Use this skill when writing or reviewing Laravel/PHP code — a controller, a FormRequest, a service, a job, a migration, an Eloquent query, a model event, a queued or bulk operation — and whenever a symptom shows up: a controller that grew into the business logic, an N+1 found in the logs, a bulk command that runs out of memory, a job that retries something it should not, a soft-deleted row reappearing in a count, a model event that fires on a mass update and does not. It applies to any Laravel version: the rules are about the shape of the application. Do not use it for a security review (padosoft-laravel-security-review), for what goes in a log (padosoft-logging-discipline), or for infrastructure and deployment.
padosoft/skills · ★ 1 · DevOps & Infrastructure · score 80

Install: claude install-skill padosoft/skills

# Laravel conventions **None of this depends on a framework or language version.** These are rules about how the application is shaped — where the logic lives, what crosses a boundary, what the database is asked to do — and they were earned on codebases several major versions apart. A rule that only held on one version would not be a rule, it would be a release note. For a **new** project, start from the current Laravel and PHP, a formatter and a static analyser, and the test framework the repository already chose. On an **existing** codebase apply the same rules with that project's idiom, and do not mix a new idiom with the legacy one halfway through a file — a file that does both is harder to read than a file that is consistently old. Where a version genuinely moved something it is noted inline. In every one of those cases what moved was the *file*, not the rule. --- ## 1. The flow: FormRequest → DTO → Service → Resource For any endpoint or form that is not trivial: 1. **`FormRequest`** validates and normalises the HTTP input; 2. the **controller** builds an explicit **DTO**; 3. the **service** (or action) runs the application logic; 4. the **controller** turns the outcome into a response, redirect or `JsonResource`. What each step buys: the data contract stops being an untyped array crossing boundaries, the service is testable without HTTP, and the controller has one job — translating. **The controller never contains business logic.** The signal it has drifted: it