static-analysis – Page 9 – Türker Yıldırım

The PHPStan baseline is a debt register

NoteFebruary 4, 20201 min read

A generated file recording every existing error is the thing that makes static analysis adoptable on a codebase that has never had any. Reading it once by directory…

Failing on a growing baseline is the whole ratchet

NoteJanuary 31, 20202 min read

A baseline that can grow is a suppression file, and one that can only shrink is a debt that gets paid — the difference is one CI step.…

Typed properties and the constructor that got shorter

Deep diveDecember 25, 201910 min read

7.4 landed on 28 November and the docblock is no longer the only type. Uninitialised is a new state, and arrow functions remove the use() clause.

Generate a PHPStan baseline and fail on growth

SnippetDecember 25, 20191 min read

The PHPStan baseline is a debt register, not configuration

NoteDecember 24, 20192 min read

0.12 shipped in December with a baseline generator, and it is the feature that makes static analysis adoptable on a codebase that has never had any. The file…

Failing on a growing baseline, which is the whole ratchet

NoteDecember 10, 20192 min read

A baseline that can grow is a suppression file, and a baseline that can only shrink is a debt that gets paid — the difference is one CI…

A baseline is what makes static analysis adoptable

Deep diveDecember 10, 201914 min read

0.12 shipped in December and the ignoreErrors list can be deleted. A generated debt register, a ratchet that only shrinks, and a level to stop at.

Static analysis on changed files in a pre-commit hook

NoteNovember 14, 20191 min read

A full analysis on a large codebase takes long enough that nobody runs it before committing, so every finding arrives from CI after the context has been lost.…

Laravel 6 adopted semver, and the upgrade got boring

Deep diveSeptember 25, 20199 min read

5.8 to 6.0 is a smaller change than 5.7 to 5.8 was, which is the point. What semver means for a framework, and what LTS actually promises.

A PHPStan extension for a magic method the analyser cannot see

NoteJune 17, 20192 min read

Frameworks built on __call and facades produce hundreds of false positives, and the answer is not to lower the level but to teach the analyser what those calls…