composer.json

    "require-dev": {
        "drupal/coder": "^8.2",
        "jakub-onderka/php-parallel-lint": "^0.9.2",
        "phpmd/phpmd": "^2.6",
        "phpro/grumphp": "^0.11.6",
        "phpunit/phpunit": "^5",
        "sebastian/phpcpd": "^3.0",
        "sensiolabs/security-checker": "^4.1"
    },

grumphpy.yml

parameters:
    git_dir: .
    bin_dir: bin
    tasks: 
        composer: ~
        jsonlint:
            detect_key_conflicts: true
        phpmd:
            exclude: ['vendor', 'web/core', 'web/modules/contrib']
            triggered_by: ['php', 'inc', 'module']
        phpcpd:
            directory: web/modules/custom
        phpcs:
            standard: vendor/drupal/coder/coder_sniffer/Drupal/
            whitelist_patterns: [/^web\/modules\/custom\/(.*)/]
            triggered_by: ['php', 'inc', 'module']
        phplint: 
            exclude: ['vendor', 'web/core', 'web/modules/contrib']
            triggered_by: ['php', 'inc', 'module']
        securitychecker: ~
        xmllint: ~
        yamllint: ~