Skip to content

static-analysis.md

Latest commit

 

History

History
89 lines (62 loc) · 1.92 KB

static-analysis.md

File metadata and controls

89 lines (62 loc) · 1.92 KB
Raw

PHP Static Analysis

PHPStan is the static analysis tool chosen for this setup. The VS Code extension list already includes sanderronde.phpstan-vscode, so projects should standardize on PHPStan rather than splitting between multiple analyzers.

Install PHPStan per project with Composer. Do not install it globally with Homebrew.

Installation

For a Symfony project:

composer require --dev \
  phpstan/phpstan \
  phpstan/extension-installer \
  phpstan/phpstan-symfony \
  phpstan/phpstan-doctrine

For a non-Symfony PHP project:

composer require --dev phpstan/phpstan

Configuration

Create phpstan.neon in the project:

parameters:
    level: 5
    paths:
        - src
        - tests

Start at a level the project can sustain, then raise it progressively. Avoid jumping directly to the maximum level on legacy applications.

Composer scripts

Add a project script:

{
  "scripts": {
    "analyse": "phpstan analyse --memory-limit=1G"
  }
}

Run it with:

composer analyse

PHPStan static analysis passing with no errors

Baseline strategy

Use a baseline only for existing projects with known debt:

vendor/bin/phpstan analyse --generate-baseline

Commit the baseline with the project, then reduce it over time. Do not use a baseline to hide new errors in new code.

IDE integration

The recommended VS Code extensions include PHPStan integration. Keep project-specific binary paths in the project's .vscode/settings.json when the extension cannot auto-detect vendor/bin/phpstan.

Psalm

Psalm is intentionally not the default analyzer for this setup. PHPStan is already reflected in the editor extensions and keeps the project workflow focused on one primary static-analysis tool.

← Docs index · Project README