Our mediawiki/mediawiki-codesniffer ships with an utility that can be used as a bootstrapper to alter the configuration, that is used on CI to only lint files that have been changed by the patchset.

<?xml version="1.0"?>
<ruleset>
    <file>.</file>
    <arg name="bootstrap" value="./vendor/mediawiki/mediawiki-codesniffer/utils/bootstrap-ci.php"/>
    <arg name="extensions" value="php,php5,inc"/>

The boostrap script has:

# Only filter when running from cli and using Jenkins
if ( !( PHP_SAPI === 'cli' && getenv( 'JENKINS_URL' ) !== false ) ) {
    return;
}

Else it looks at files changed in the head and pass them as arguments to the phpcs command, overriding the <file>.</file> in .phpcs.xml.

On your local machine, the bootstrap script would early return unless you set the environment variable JENKINS_URL. So one should be able to reproduce the behavior locally via:

$ JENKINS_URL=1 composer test

The reason the change started failing is the patch got rebased without taking in account that mediawiki/mediawiki-codesniffer has meanwhile been upgraded in the branch.

Change 491417 had a related patch set uploaded (by Brian Wolff; owner: Brian Wolff):
[mediawiki/tools/phan/SecurityCheckPlugin@master] Remove phpcs bootstrap.

https://gerrit.wikimedia.org/r/491417

The reason the change started failing is the patch got rebased without taking in account that mediawiki/mediawiki-codesniffer has meanwhile been upgraded in the branch.

Its a little confusing, as patches using the old old composer.json with the old version of codesniffer seemed to still fail. Like PS1 of https://gerrit.wikimedia.org/r/#/c/mediawiki/tools/phan/SecurityCheckPlugin/+/491257/1 . But the jenkins output seemed to indicate it used the wrong version of codesniffer...

Change 491417 merged by Brian Wolff:
[mediawiki/tools/phan/SecurityCheckPlugin@master] Remove phpcs bootstrap.

https://gerrit.wikimedia.org/r/491417