Add Autoloaded_Options_Check for missing $autoload parameter

[faisalahammad]

What?

Closes #28

Adds a new check, autoloaded_options, that warns plugin authors when add_option() or update_option() is called without explicitly setting the $autoload parameter.

Why?

The $autoload parameter on add_option() and update_option() defaults to true, which loads the option on every page request. Plugins that accumulate autoloaded options bloat the alloptions row, and every WordPress request slows down. Letting the author decide explicitly improves performance across the install.

How?

Custom PHPCS sniff PluginCheck.CodeAnalysis.AutoLoadedOptions that wraps AbstractFunctionParameterSniff. The sniff targets the two call sites (the $autoload parameter sits at position 4 on add_option after a deprecated arg, and at position 3 on update_option). Calls without an explicit $autoload produce a single warning per call site; an explicit boolean true or false is left untouched, including the WP 6.6+ recommendation to pass boolean autoload instead of 'yes'/'no' strings.

A new check class Autoloaded_Options_Check registers the sniff under the performance category. It is wired into Default_Check_Repository under the autoloaded_options slug.

Files touched:

• phpcs-sniffs/PluginCheck/Sniffs/CodeAnalysis/AutoLoadedOptionsSniff.php (new sniff)
• phpcs-sniffs/PluginCheck/Tests/CodeAnalysis/AutoLoadedOptionsUnitTest.{inc,php} (sniff unit test)
• phpcs-sniffs/PluginCheck/ruleset.xml (registers the new rule)
• includes/Checker/Checks/Performance/Autoloaded_Options_Check.php (check class)
• includes/Checker/Default_Check_Repository.php (registration)
• docs/checks.md (new row)
• tests/phpunit/testdata/plugins/test-plugin-autoloaded-options-check-{with,without}-errors/load.php (PHPUnit fixtures)
• tests/phpunit/tests/Checker/Checks/Autoloaded_Options_Check_Tests.php (PHPUnit integration test)

Testing Instructions

1. Apply the patch and activate plugin-check in a WordPress install.
2. Run wp plugin-check list-checks and confirm autoloaded_options is listed in the performance category.
3. Create a test plugin containing both forms below and run wp plugin-check check <plugin> on it.
   • Triggers a warning:

     add_option( 'opt_a' );
     add_option( 'opt_b', 'value' );
     update_option( 'opt_c' );
     update_option( 'opt_d', 'value' );

   • Clean (no warning):

     add_option( 'opt_a', 'value', '', false );
     add_option( 'opt_b', 'value', '', true );
     update_option( 'opt_c', 'value', false );
     update_option( 'opt_d', 'value', true );

4. Verify four warnings appear on the first plugin (codes PluginCheck.CodeAnalysis.AutoLoadedOptions.add_option_autoloadMissing and PluginCheck.CodeAnalysis.AutoLoadedOptions.update_option_autoloadMissing) and zero autoloaded_options results on the second.

Automated tests:

• composer test runs the PHPUnit integration tests against both fixtures.
• Sniff unit test runs via cd phpcs-sniffs && php vendor/bin/phpunit vendor/squizlabs/php_codesniffer/tests/AllTests.php --filter AutoLoadedOptions --no-coverage.

AI Usage Disclosure

• This PR was created without the help of AI tools
• This PR includes AI-assisted code or content

If AI tools were used, please describe how they were used:
Used Claude Code for code generation, refactoring and documentation drafting under direction of maintainer.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: faisalahammad <faisalahammad@git.wordpress.org>
Co-authored-by: swissspidy <swissspidy@git.wordpress.org>
Co-authored-by: davidperezgar <davidperez@git.wordpress.org>
Co-authored-by: mukeshpanchal27 <mukesh27@git.wordpress.org>
Co-authored-by: vishalkakadiya <vishalkakadiya@git.wordpress.org>
Co-authored-by: mehulkaklotar <mehulkaklotar@git.wordpress.org>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[swissspidy]

Would be nice to make some progress on WordPress/WordPress-Coding-Standards#2520 first, which would simplify things here.

[davidperezgar]

Yes, that seems reasonable.

[faisalahammad]

Thank you, @swissspidy and @davidperezgar.

It looks like multiple contributors are working on this: WordPress/WordPress-Coding-Standards#2520.

Should I close this PR?

[mukeshpanchal27]

@faisalahammad I just left a comment on the WPCS PR. Let's see how they respond.