Proposal: Support settings file e.g. .pcprc.json

Thank you to all the maintainers!

It would be great if a settings file (e.g. .phprc.json ) was supported, inspired by .eslintrc.json

It can reduce false positives and serve as a clear definition of the plugin's analysis policy.

Examples

{
  "rules": {
    "hidden_files": {
        "ignore": [ ".claude", ".gitignore" ],
    },
    "missing_direct_file_access_protection": {
        "ignore": "src"
    }
  }
}

Case 1. hidden_files

I run PCP on local development via wp-cli. Some hidden files(.claude, .gitignore) are listed in .distignore and are removed before deployment to the WordPress.org directory.

Case 2. missing_direct_file_access_protection

Some of my plugins follow PSR-0/4 structure as shown below:

src/
  - Vendor/
    - NameSpace/
      - Services/
        - Slack.php
        - Teams.php
      - Model/
        - Products.php
        - Orders.php
tempalte-parts/
  - block.php

I agree with the PSR guideline that files defining only classes or functions are safe and free of side effects.
Therefore, I’d like to exclude the src directory from this rule. However, it should still apply to files where side effects are expected, such as template files template-parts/*.php.

Concerns

Case 1 is compatible with both local development and WordPress.org directory because .pcprc.json is removed during the deployment process.

However, to support Case 2, we would need to include .phprc.json in the distribution zip. This might conflict with the hidden_files rule itself.

Thanks! I look forward to your feedback.

Related: #1154

Start by reading related issue #1154 and the proposal's examples for .pcprc.json or .phprc.json. Review how the hidden_files and missing_direct_file_access_protection rules currently receive policy, then determine the required configuration and distribution behavior. Done means a decided, documented approach for rule-specific ignores without undermining deployment checks.