Static code analysis

[borekb]

During the past two years, I have spent most of my time in TypeScript and going back to PHP feels... not very pleasant to be honest. We can't do much about the language but we could modernize our codebase, for example, bump required version of PHP and use newer language features (#1408), or introduce more static checking.

We already have an issue about PHPStan – #1210 – however, I recently read this amazing article which discusses these tools:

• PHPStan
• Phan
• Psalm
• PhpStorm

It sparked my interest and I researched this area briefly. Here are the notes:

• It's possible to use all three tools at once, as that article shows.
• All three seem very good. Even using one of them would be a great benefit for VersionPress.
• All have VSCode extensions. (Neither is supported directly in PhpStorm which probably isn't a surprise.)
• I'm most inclined to use Psalm at this point because:
  • It has its own type hints like @psalm-param Closure(int):bool or @psalm-param 'Yes'|'No' which is awesome. (I believe that the tool needs to introduce some sort of its syntax because PHP & PHPDoc are not enough to describe the types properly.)
  • It's the most recent one so hopefully it learned from the others.
  • Has corporate backing (Vimeo).
  • Browsing Reddit while looking for for all three tools, there seem to positive sentiment around Psalm.
  • It can fix / update code.
• Other tools I encountered during the research:
  • PhpMetrics
  • PHP-CS-Fixer
  • phpcpd: Copy/Paste Detector (CPD) for PHP code
  • grumphp: A PHP code-quality tool
  • Php Inspections (EA Extended) – PhpStorm plugin
  • What code quality tools does everyone use? (Reddit)
  • Docker container with most of the tools installed: jakzal/phpqa

I plan to experiment with Psalm soon.

[borekb]

I have a hard time installing Psalm because we use some older libraries around Selenium which require older versions of PHPUnit which require a different version of phpdocumentor/reflection-docblock that what Psalm needs 😕.

That's bad because we can't easily upgrade. <Insert a rant here about how this wouldn't be a problem at all in JavaScript / npm, how I dislike the concept of classes, etc.>

I'm not sure how to resolve this. Psalm has a relatively long list of dependencies, as does any serious tool. Conflicts in versions are likely. What does the PHP world do in these situations?

[borekb]

This should be the solution:

https://github.com/bamarni/composer-bin-plugin

I hope it works reliably.