Skip to content

chore: migrate static code analysis to PHPStan#38

Merged
loks0n merged 18 commits intoutopia-php:mainfrom
autinn:cicd-35-migrate-static-code-from-psalm-to-phpstan
Jul 26, 2025
Merged

chore: migrate static code analysis to PHPStan#38
loks0n merged 18 commits intoutopia-php:mainfrom
autinn:cicd-35-migrate-static-code-from-psalm-to-phpstan

Conversation

@autinn
Copy link
Contributor

@autinn autinn commented Mar 26, 2025

Implemented static code analysis in [utopia-php/image](https://github.com/utopia-php/image)

  1. Remove Psalm code analysis in Dockerfiles, psalm.xml, composer.json, and composer.lock.

  2. Install and configure PHPStan in Dockerfiles, phpstan.neon, composer.json, and composer.lock.

  • declared semantic versioning for minor and patch version as ^1.8.0 as suggested in reference repository open-runtimes/executor
  • ran composer update to update composer.lock file
  1. Add command to run static code analysis
  • ran composer check for phpstan from level 1-8 strictness
  • removed code redundancy in src/Image.php by commenting on unnecessary lines of code to resolve error at level=4
  1. Add Github Automation
  • added code-analysis.yml to run composer check and composer linter
  • updated composer version to 2.0 across .github/workflows file to match composer version in Dockerfiles
  • tested Github checks with sub-branches

Summary by CodeRabbit

  • Chores

    • Updated development dependencies and static analysis configuration, switching from Psalm to PHPStan.
    • Removed unused configuration and workflow files related to previous static analysis and linting tools.
    • Updated linter workflow to use a specific Composer version and added an extra check step.
    • Added a suggestion for the Imagick PHP extension.
    • Added a newline at the end of the test workflow file for formatting consistency.
  • Refactor

    • Improved code style and type consistency in image processing classes.
    • Renamed test methods to use snake_case and adjusted method visibility for consistency.
    • Enhanced test assertions to verify file existence, content, and image dimensions more explicitly.

autinn and others added 16 commits March 11, 2025 12:13
…ation

Co-authored-by: Wannida Polchan <wannida.p1209@gmail.com>
Co-authored-by: Sabrina Diaz-Erazo <sdiazera@gmail.com>
Sabrina Diaz-Erazo sdiazera@gmail.com
Wannida Polchan wannida.p1209@gmail.com
Co-authored-by: Sabrina Diaz-Erazo sdiazera@gmail.com
Co-authored-by: Wannida Polchan wannida.p1209@gmail.com
Wannida PolChan <wannida.p1209@gmail.com>
Sabrina Diaz-Erazo <sdiazera@gmail.com>
Co-authored-by: Wannida PolChan <wannida.p1209@gmail.com>
Co-authored-by: Sabrina Diaz-Erazo <sdiazera@gmail.com>
Co-authored-by: Wannida PolChan <wannida.p1209@gmail.com>
Co-authored-by: Sabrina Diaz-Erazo <sdiazera@gmail.com>
Copy link
Contributor

@loks0n loks0n left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR!

Left some comments.

- name: Run Linter
run: |
docker run --rm -v $PWD:/app composer sh -c \
docker run --rm -v $PWD:/app composer:2.0 sh -c \
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we use composer:2.6.6 in most places.

Can you switch to that?

Copy link
Contributor Author

@autinn autinn Apr 26, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Using composer:2.6.6 requires us to change the phpstan version from ^1.8.0 to 2.1.x, is that fine?
Screenshot 2025-04-26 at 5 43 17 PM


$this->assertEquals(\is_readable($target), true);
$this->assertNotEmpty(\md5(\file_get_contents($target) ?: ''));
// $this->assertNotEmpty(\md5(\file_get_contents($target) ?: ''));
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you explain the reasoning for this change?

It'd be best if we can maintain the existing tests and assertions.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If this code is triggering a PHPStan issue, Is there another way to solve it?

@stnguyen90 stnguyen90 requested a review from loks0n June 2, 2025 21:58
@coderabbitai
Copy link

coderabbitai bot commented Jul 26, 2025

Walkthrough

This update removes Psalm static analysis support in favor of PHPStan, updates development dependencies in composer.json, and adjusts Dockerfiles to include PHPStan configuration. The linter workflow now uses a specific Composer version and runs both composer lint and composer check. Test and source files receive minor refactors, naming convention updates, and assertion improvements. The CodeQL workflow is deleted.

Changes

File(s) Change Summary
.github/workflows/codeql-analysis.yml, psalm.xml Deleted CodeQL workflow and Psalm static analysis configuration.
.github/workflows/linter.yml Updated Docker image to composer:2.6 and added composer check after composer lint.
Dockerfile-php-8.1, Dockerfile-php-8.2, Dockerfile-php-8.3 Swapped Psalm config for PHPStan config by copying phpstan.neon instead of psalm.xml.
composer.json Upgraded dev dependencies, removed Psalm, added suggest section for Imagick extension.
phpstan.neon Added new PHPStan configuration file with strictest analysis and path exclusions.
src/Image/Image.php Made gravity constants explicitly public const string, fixed property type, minor code and docblock tweaks.
tests/Image/ImageTest.php Renamed test methods to snake_case, changed setup/teardown to protected, replaced MD5 assertions with file existence and content checks, added dimension checks, and relaxed file size assertions for AVIF/HEIC.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Poem

🐇
Goodbye, Psalm, you served us well,
PHPStan now rings the bell.
Composer’s newer, tests are neat,
Lint and check—our code’s elite!
Dockerfiles swap config in a hop,
This bunny’s work will never stop.
Onward to the next code crop!

Note

⚡️ Unit Test Generation is now available in beta!

Learn more here, or try it out under "Finishing Touches" below.


📜 Recent review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 9ab4692 and d87db1c.

⛔ Files ignored due to path filters (1)
  • composer.lock is excluded by !**/*.lock
📒 Files selected for processing (7)
  • .github/workflows/codeql-analysis.yml (0 hunks)
  • .github/workflows/linter.yml (1 hunks)
  • .github/workflows/tests.yml (1 hunks)
  • composer.json (1 hunks)
  • phpstan.neon (1 hunks)
  • src/Image/Image.php (7 hunks)
  • tests/Image/ImageTest.php (56 hunks)
💤 Files with no reviewable changes (1)
  • .github/workflows/codeql-analysis.yml
✅ Files skipped from review due to trivial changes (2)
  • .github/workflows/tests.yml
  • src/Image/Image.php
🚧 Files skipped from review as they are similar to previous changes (4)
  • .github/workflows/linter.yml
  • phpstan.neon
  • composer.json
  • tests/Image/ImageTest.php
✨ Finishing Touches
  • 📝 Generate Docstrings
🧪 Generate unit tests
  • Create PR with unit tests
  • Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share
🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

  • Review comments: Directly reply to a review comment made by CodeRabbit. Example:
    • I pushed a fix in commit <commit_id>, please review it.
    • Explain this complex logic.
    • Open a follow-up GitHub issue for this discussion.
  • Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
    • @coderabbitai explain this code block.
    • @coderabbitai modularize this function.
  • PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
    • @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
    • @coderabbitai read src/utils.ts and explain its main purpose.
    • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
    • @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

  • @coderabbitai pause to pause the reviews on a PR.
  • @coderabbitai resume to resume the paused reviews.
  • @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
  • @coderabbitai full review to do a full review from scratch and review all the files again.
  • @coderabbitai summary to regenerate the summary of the PR.
  • @coderabbitai generate docstrings to generate docstrings for this PR.
  • @coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
  • @coderabbitai generate unit tests to generate unit tests for this PR.
  • @coderabbitai resolve resolve all the CodeRabbit review comments.
  • @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
  • @coderabbitai help to get help.

Other keywords and placeholders

  • Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
  • Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
  • Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

  • You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
  • Please see the configuration documentation for more information.
  • If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

  • Visit our Documentation for detailed information on how to use CodeRabbit.
  • Join our Discord Community to get help, request features, and share feedback.
  • Follow us on X/Twitter for updates and announcements.

@loks0n loks0n changed the title Issue 35 Migrate static code analysis from Psalm to PHPStan chore: migrate static code analysis to PHPStan Jul 26, 2025
Copy link

@coderabbitai coderabbitai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🧹 Nitpick comments (2)
.github/workflows/linter.yml (1)

19-20: Pin the Composer image to a patch version to keep builds reproducible.

composer:2.6 floats to the latest 2.6.x. A future 2.7 bump inside that tag (it has happened before) can introduce breaking behaviour and unstable CI.

-        docker run --rm -v $PWD:/app composer:2.6 sh -c \
+        docker run --rm -v $PWD:/app composer:2.6.6 sh -c \

This also aligns with the comment in the previous review thread requesting 2.6.6.

src/Image/Image.php (1)

203-205: Non-standard DocBlock formatting

The @param lines include colons (:) inside the description field. This deviates from php-doc conventions and is flagged by various tooling.

- * @param  int  $borderWidth  The size of the border in pixels
- * @param  string  $borderColor  The color of the border in hex format
+ * @param int    $borderWidth  Size of the border in pixels
+ * @param string $borderColor  Border color in hex notation
📜 Review details

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between dcae5b1 and 9ab4692.

⛔ Files ignored due to path filters (1)
  • composer.lock is excluded by !**/*.lock
📒 Files selected for processing (10)
  • .github/workflows/codeql-analysis.yml (0 hunks)
  • .github/workflows/linter.yml (1 hunks)
  • Dockerfile-php-8.1 (1 hunks)
  • Dockerfile-php-8.2 (1 hunks)
  • Dockerfile-php-8.3 (1 hunks)
  • composer.json (1 hunks)
  • phpstan.neon (1 hunks)
  • psalm.xml (0 hunks)
  • src/Image/Image.php (7 hunks)
  • tests/Image/ImageTest.php (30 hunks)
💤 Files with no reviewable changes (2)
  • psalm.xml
  • .github/workflows/codeql-analysis.yml
🧰 Additional context used
🪛 PHPStan (2.1.17)
src/Image/Image.php

12-12: Class constants with native types are supported only on PHP 8.3 and later.

(classConstant.nativeTypeNotSupported)


14-14: Class constants with native types are supported only on PHP 8.3 and later.

(classConstant.nativeTypeNotSupported)


16-16: Class constants with native types are supported only on PHP 8.3 and later.

(classConstant.nativeTypeNotSupported)


18-18: Class constants with native types are supported only on PHP 8.3 and later.

(classConstant.nativeTypeNotSupported)


20-20: Class constants with native types are supported only on PHP 8.3 and later.

(classConstant.nativeTypeNotSupported)


22-22: Class constants with native types are supported only on PHP 8.3 and later.

(classConstant.nativeTypeNotSupported)


24-24: Class constants with native types are supported only on PHP 8.3 and later.

(classConstant.nativeTypeNotSupported)


26-26: Class constants with native types are supported only on PHP 8.3 and later.

(classConstant.nativeTypeNotSupported)


28-28: Class constants with native types are supported only on PHP 8.3 and later.

(classConstant.nativeTypeNotSupported)

🔇 Additional comments (5)
Dockerfile-php-8.2 (1)

23-23: Good replacement, but remember to run PHPStan inside the image.

Copying phpstan.neon keeps the container self-contained; ensure the corresponding phpstan CLI invocation (likely via composer check) is executed in your CI so the file isn’t left unused.

Dockerfile-php-8.1 (1)

23-23: Same remark as 8.2 Dockerfile – config present, execution path not shown.
If the build image is ever used outside CI, consider adding a dedicated stage or script to run phpstan analyse so developers can reproduce results locally.

Dockerfile-php-8.3 (1)

23-23: Config copied – looks fine.

No issues spotted. Keep the three Dockerfiles in sync when future PHPStan options change.

composer.json (1)

22-24: PHPUnit 12 conflicts with the stated PHP ≥ 8.1 requirement

phpunit/phpunit 12.x needs PHP 8.2+. The library still advertises "php": ">=8.1" and Dockerfiles build 8.1 & 8.2 images, so a default install on 8.1 will now fail.

Either (preferred) stay on PHPUnit 11, or raise the minimum PHP version to 8.2 and drop the 8.1 CI image.

Example rollback:

-        "phpunit/phpunit": "12.2.*",
+        "phpunit/phpunit": "^11.1",

Likely an incorrect or invalid review comment.

tests/Image/ImageTest.php (1)

10-12: Good upgrade to modern PHPUnit visibility

Migrating setUp()/tearDown() to protected visibility aligns with PHPUnit ≥ 10 guidelines.

@loks0n loks0n force-pushed the cicd-35-migrate-static-code-from-psalm-to-phpstan branch from 9ab4692 to 1bfb3fe Compare July 26, 2025 16:45
@loks0n loks0n force-pushed the cicd-35-migrate-static-code-from-psalm-to-phpstan branch from 1bfb3fe to d87db1c Compare July 26, 2025 16:48
@loks0n loks0n merged commit b7ac5b8 into utopia-php:main Jul 26, 2025
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants