`phpcs-only` attribute is not always respected

Describe the bug

When using the phpcs-only or phpcbf-only attributes within a ruleset, the reports from phpcs do not look as expected.

Code sample

<?php

function main() {
  return 1;
  return 2;
}

Custom ruleset

<?xml version="1.0"?>
<ruleset>
    <file>test.php</file>

    <arg name="basepath" value="."/>
    <arg name="colors"/>
    <arg value="s"/>

    <rule ref="Squiz.WhiteSpace.FunctionSpacing" phpcs-only="true"/>

    <rule ref="Squiz.PHP.NonExecutableCode" />
</ruleset>

To reproduce

Steps to reproduce the behavior:

Create a file called test.php with the code sample above.
Create a file called phpcs.xml with the custom ruleset above.
Run phpcs

See the output displayed


FILE: test.php
--------------------------------------------------------------------------------------------------------------------------
FOUND 1 ERROR AND 1 WARNING AFFECTING 2 LINES
--------------------------------------------------------------------------------------------------------------------------
6 | ERROR   | [x] Expected 2 blank lines before function; 4 found (Squiz.WhiteSpace.FunctionSpacing.Before)
8 | WARNING | [ ] Code after the RETURN statement on line 7 cannot be executed (Squiz.PHP.NonExecutableCode.Unreachable)
--------------------------------------------------------------------------------------------------------------------------
PHPCBF CAN FIX THE 1 MARKED SNIFF VIOLATIONS AUTOMATICALLY
--------------------------------------------------------------------------------------------------------------------------

Time: 18ms; Memory: 6MB

5. Run `phpcbf`
6. See the output displayed
  ```text
No fixable errors were found

Time: 17ms; Memory: 6MB

Note the discrepancy between output from phpcs and phpcbf regarding "fixable" error.

Screenshot_2024-07-27_10-49-58

Expected behaviour

The errors reported by phpcs as fixable should be fixed by phpcbf.

Versions (please complete the following information)


Operating System	Debian Stable
PHP version	8.3
PHP_CodeSniffer version	3.10.2 (also tested with a3d11a96b68bb837e58e859f4376784d75aa2733 which is the current `master` branch at time of writing)
Standard	custom
Install type	Composer (global for v3.10.2, local for `master` branch)

Additional context

There are some words describing how the phpcs-only and phpcbf-only attributes should work here: https://github.com/PHPCSStandards/PHP_CodeSniffer/wiki/Annotated-Ruleset#selectively-applying-rules

Please confirm

[x] I have searched the issue list and am not opening a duplicate issue.
[x] I have read the Contribution Guidelines and this is not a support question.
[x] I confirm that this bug is a bug in PHP_CodeSniffer and not in one of the external standards.
[x] I have verified the issue still exists in the master branch of PHP_CodeSniffer.

PHPCSStandards / PHP_CodeSniffer

`phpcs-only` attribute is not always respected #577