Laravel & Artisan

Installing the package in a Laravel application registers one Artisan command through package discovery:

php artisan worker-safety:scan
php artisan worker-safety:scan app --runtime=octane --fail-on=medium
php artisan worker-safety:scan --format=sarif --no-progress

It is the same command as vendor/bin/worker-safety scan, not a reimplementation of it: identical arguments, options, output formats, baseline handling and exit codes. Anything documented for scan works here unchanged.

The one difference is the default project root. Artisan can be invoked from any directory, so the scan defaults to the application’s base_path() rather than the current working directory. --project-dir still overrides it, and a relative value is resolved against the application root:

# Scans the application, wherever you run it from
php artisan worker-safety:scan

# Scans a package inside the repository instead
php artisan worker-safety:scan --project-dir=packages/billing

No scanning happens during an HTTP request, and the Artisan command is not registered there either — the provider’s boot() returns early outside the console. Be precise about what that does and does not mean: in an install that has dev dependencies, a discovered provider is loaded on every request, and this one’s register() adds a single container binding. Nothing else runs. In a production install built with --no-dev the package is not present at all, so there is no provider to discover.

Supported Laravel versions

Version	Status
Laravel 13	Verified: same checks, on PHP 8.5 with symfony/console 8. Laravel 13 requires symfony/console ^7.4 or ^8.0, which is why the package accepts Symfony 8.
Laravel 12	Verified: package discovery, all documented options, JSON and SARIF output, baseline round-trip and every exit code.
Laravel 11	Verified: same checks. On PHP 8.5 the framework itself emits deprecation notices during bootstrap that land on stdout, which will corrupt --format=json or --format=sarif output — that is Laravel 11 on PHP 8.5, not this package, and php artisan list does it too. PHP 8.2–8.4 is unaffected.
Laravel 10	Not verified. The package’s constraints (PHP ^8.2, symfony/console ^6.4, ^7.0 or ^8.0) do not exclude it, but it has not been tested, so no support is claimed.

If package discovery is disabled

Projects that opt out of discovery — either globally, or by listing this package under extra.laravel.dont-discover — should register the provider by hand.

In Laravel 11 and 12, add it to bootstrap/providers.php:

return [
    App\Providers\AppServiceProvider::class,
    WorkerSafety\Integration\Laravel\WorkerSafetyServiceProvider::class,
];

In Laravel 10, add it to the providers array in config/app.php:

'providers' => [
    // …
    WorkerSafety\Integration\Laravel\WorkerSafetyServiceProvider::class,
],

Because the package is a dev dependency, guard the registration if the same file is used for a production build without dev dependencies:

if (class_exists(WorkerSafety\Integration\Laravel\WorkerSafetyServiceProvider::class)) {
    // register it
}

Laravel is never a runtime dependency of this package. In a project without it, vendor/bin/worker-safety behaves exactly as documented everywhere else in this README, and nothing under WorkerSafety\Integration\Laravel is ever autoloaded.