Analysing the tests as well as the source

Test code is usually excluded from static analysis on the grounds that it is not production code, which is where a good proportion of the useful findings are — a mock configured against a method that no longer exists passes silently.

parameters:
    level: 5
    paths:
        - src
        - tests

includes:
    - vendor/phpstan/phpstan-phpunit/extension.neon

The PHPUnit extension is what makes it bearable: without it, every createMock() return is MockObject and every method call on it is an error. With it, the analyser understands the intersection type and checks that the mocked method exists on the real class — which is the single most valuable thing analysing tests gives you.