Failing on a growing baseline is the whole ratchet

A baseline that can grow is a suppression file, and one that can only shrink is a debt that gets paid — the difference is one CI step.

#!/usr/bin/env bash
set -euo pipefail

vendor/bin/phpstan analyse --no-progress     # fails on anything NEW

before=$(git show "origin/main:phpstan-baseline.neon" | grep -c 'message:')
after=$(grep -c 'message:' phpstan-baseline.neon)

[ "$after" -le "$before" ] || { echo "baseline grew: $before → $after"; exit 1; }
echo "baseline: $before → $after"

The first command alone is most of the value: new code is analysed and old code is ignored, so the tool is useful from the first day. The second stops the obvious workaround, which is regenerating the baseline to make a red build green — always available and always tempting at five on a Friday. Printing both numbers in the build output makes the trend visible without anybody looking for it.