Reducing Bugs With Static Code Analysis php tek 2025

Reducing Bugs With Static
Code Analysis
Scott Keck-Warren
php tek 2025
https://scott.keck-warren.com/
https://tinyurl.com/sca-php-tek-2025

How We Fixed Bugs (Don’t Do This)
1. Duplicate the bug
2. Fix it
3. Open SFTP connection to production
4. Manually edit the file
5. Cross our fingers nothing broke

Parse error: syntax error, unexpected identifier "privte",
expecting "function" or "const"

Fatal error: Uncaught Error:
Call to undefined method User::getId()

What Happened?
• Type errors
• Left over `echo` debug statements
• `exit` in unexpected spot

What’s the Fix?
Production
Change

What’s the Fix?
Production
Change
?

Reducing Bugs With Static
Code Analysis
Scott Keck-Warren
php[tek] 2025
https://scott.keck-warren.com/

use PsrHugHuggable; // PSR-8
class ScottKeckWarren implements Huggable
{
public function hug(Huggable $h)
{
// only if asked
}
}

{
use Partner;
{
// only if asked
}
}

{
use Partner;
use BestDadEver;
{
// only if asked
}
}

{
use Partner;
use BestDadEver;
use PhpDeveloper;
{
// only if asked
}
public function getTitle(): string
{
return "Senior Software Engineer";
}
}

{
use Partner;
use BestDadEver;
use PhpDeveloper;
use ContentCreator
{
// only if asked
}
public function getTitle(): string
{
return "Senior Software Engineer";
}
}

Agenda
1. What is Static Code Analysis?
2. Where Do We Perform Static Code Analysis?
3. Tools For Static Code Analysis

What is Static Code Analysis?
Two Ways to Analyze Code
1. Dynamic Code Analysis
2. Static Code Analysis

Dynamic Code Analysis
• Run code (manually or automatically)
• Manual: slow and expensive
• Automated: slow to create but infinitely repeatable

Static Code Analysis
• Analyze our source code without actually executing
• Slow onboarding (maybe) on brownfield applications
• Infinitely repeatable
• Can be faster than dynamic tests

What specifically can we do with Static Code Analysis?
• Find errors
• Adhere to standards
• Automatically refactor our code

• Teams size is not a limiting factor to using SCA
• Compute/cost can be

Where Do We Perform Static
Code Analysis?

Feedback Loops
Process
Input(s)

Feedback Loops
Process
Input(s) Output(s)

Feedback Loops
Process
Input(s) Output(s)
Coding
Requested Change(s) Finished Code
Refinement/Fixes

Feedback Loops:Worst Case
Process
Input(s
)
Output(s
)

Feedback Loops:Worst Case
• Change is made
• Change is pushed to production
• Problem found in the near or far future
• Problem is completely divorced from
original change
• Leads to Confusion
• What caused this?
Process
Input(s
)
Output(s
)

Feedback Loops:Okay Case
• Change is made on own branch
• Change is heavily tested on testing
server
• Problem found during testing
• Problem solved quickly because change
is still fresh in our mind
Process
Input(s
)
Output(s
)

Feedback Loops:Better Case
• Change is made on own branch
• Change is heavily tested locally
• Problem found before code leaves our
computer
• Problem solved quicker but still delayed
Process
Input(s
)
Output(s
)

Feedback Loops:Best Case
• Change is made on a file
• Changes are tested as we save/type
• Problem found immediately
• Problem solved immediately
Process
Input(s
)
Output(s
)

Where Do We Run Static Code Analysis?
Best
Okay
Better
F
a
s
t
e
r
F
e
e
d
b
a
c
k
M
o
r
e
S
a
f
e
t
y

Best
Test Server
Better
F
a
s
t
e
r
F
e
e
d
b
a
c
k
M
o
r
e
S
a
f
e
t
y

Test Server
• Goal: Going to give us secure base
• Can’t be skipped or ignored
• All tools run
• All files
• Slow
Best
Test Server
Better
F
a
s
t
e
r
F
e
e
d
b
a
c
k
M
o
r
e
S
a
f
e
t
y

Test Server
• Lots of options for this
• Quickly talk about GitHub Actions
• Quick to setup
• “Infinitely” scaleable
Best
Test Server
Better
F
a
s
t
e
r
F
e
e
d
b
a
c
k
M
o
r
e
S
a
f
e
t
y

Test Server
• Several Ways to Configure
• One Job For All Tools
• Tools Run In Series
• Multiple Jobs/Actions For Each Tool
• Tools Run in Parallel
• Setup Dependencies Between Jobs
Best
Test Server
Better
F
a
s
t
e
r
F
e
e
d
b
a
c
k
M
o
r
e
S
a
f
e
t
y

Large Project Actions
Production
Change

Production
Change
Dynamic
Automated
Tests

Production
Change
Dynamic
Automated
Tests
Static

Production
Change
Dynamic
Slowest
Static
Fast
Slower
Slower
Still
Slower
Still
Slower

Production
Change
Dynamic
Slowest
Static
Lint
Slower PHPStan
Slower
Still
Slower

Best
Test Server
Pre-Commit
F
a
s
t
e
r
F
e
e
d
b
a
c
k
M
o
r
e
S
a
f
e
t
y

Before Commit Is Created
• Build off secure base
• Balance of tools
• Changed files only
• Faster
Best
Test Server
Pre-Commit
F
a
s
t
e
r
F
e
e
d
b
a
c
k
M
o
r
e
S
a
f
e
t
y

Before Commit Is Created: How?
• Run files manually
• Copy and paste each file
• Skip this step SO fast
Best
Test Server
Pre-Commit
F
a
s
t
e
r
F
e
e
d
b
a
c
k
M
o
r
e
S
a
f
e
t
y

Before Commit Is Created: How?
• Run files automatically
• Use pre-commit functionality
Best
Test Server
Pre-Commit
F
a
s
t
e
r
F
e
e
d
b
a
c
k
M
o
r
e
S
a
f
e
t
y

Pre-Commit Script
git add .
git commit -m “changes”
Commit Created

Pre-Commit Script
git add .
git commit -m “changes”
Commit Created
Pre-
commit
Denied

Pre-Commit Script
• Located at “.git/hooks/pre-commit”
• NOT part of repo so not kept up to date
• Can be skipped (using “-n” or by deleting the file)
• That’s why we have a secure test server base

Pre-Commit Script
• Make a minimal “pre-commit” script that calls `make pre-commit`
• Keep copy in “scripts” directory
• Use composer to install the “pre-commit” script
• See https://github.com/warren5236/ScottsValueObjects

Pre-Commit Script
Our Pre-commit script’s goals:
1. Give us fast feedback loop
2. Only run on files we changed
3. Run as many tools as possible

git diff
—diff-filter=AM
—name-only
—cached
app tests | grep ".php$"

Makefile
## PreCommit Section
pre-commit:

Makefile
CHANGED_PHP_FILES = git diff --diff-filter=AM --staged --name-only src tests | grep ".php"
pre-commit:

Makefile
pre-commit: phpcs_changed
phpcs_changed:
${CHANGED_PHP_FILES} | xargs vendor/bin/phpcs --standard=phpcs.xml

Makefile
pre-commit: phpcs_changed phpstan_changed
phpcs_changed:
phpstan_changed:
${CHANGED_PHP_FILES} | xargs vendor/bin/phpstan analyze --memory-limit 1G

CHANGED_PHP_FILES = git diff --diff-filter=AM --staged --name-only src tests scripts | grep ".php"
pre-commit: lint_changed phpcs_changed phpstan_changed rector_changed
lint_changed:
${CHANGED_PHP_FILES} | xargs vendor/bin/parallel-lint
phpcs_changed:
phpstan_changed:
${CHANGED_PHP_FILES} | xargs vendor/bin/phpstan analyze --memory-limit 1G
rector_changed:
${CHANGED_PHP_FILES} | xargs vendor/bin/rector process --dry-run
## Full Static Code Analysis Section
phpcbf:
vendor/bin/phpcbf --standard=phpcs.xml src tests scripts
phpstan:
vendor/bin/phpstan analyze --memory-limit 1G -l9 src tests

IDE
Test Server
Pre-Commit
F
a
s
t
e
r
F
e
e
d
b
a
c
k
M
o
r
e
S
a
f
e
t
y

IDE
• Build off secure base
• Smaller Number of tools
• Changed files
• Immediate feedback
IDE
Test Server
Pre-Commit
F
a
s
t
e
r
F
e
e
d
b
a
c
k
M
o
r
e
S
a
f
e
t
y

IDE: Top Suggestions
• Errors in your face
• Don’t ignore them
• Look for integrations/extensions

https://github.com/exakat/php-static-analysis-tools

Types of SCA Tools
1. Bug Reduction
2. Rule Validation
3. Code Analysis

Focus: Scott’s Favorites
1. Free
2. Easy to use
3. Command line based

find -L src tests -name '*.php' -print0
| xargs -0 -n 1 -P 4 php -l

Linting
• src/Location/City.php
• src/Name/FirstName.php
• src/Name/LastName.php

php-parallel-lint/php-parallel-lint

./vendor/bin/parallel-lint src tests

Linting
Production
Change
Dynamic
Automated
Tests
Static
Lint

Grep
• Debugging only functions
• var_dump()
• exit
• dd()

Grep
• In most Unix environments by default
• grep -R “thing we don’t want” src tests

Grep
Production
Change
Dynamic
Automated
Tests
Static
Lint
Grep

Coding Standard
if ($value) {
thing1();
}
if ($value2)
{
thing2();
}
if ($scott)
lookMomNoBraces();

PHP_CodeSniffer
• phpcs -> validates code
• phpcbf -> fixes code (when possible)

PHP_CodeSniffer
1. Existing coding standards: PSR12, Pear, Zend, etc
2. Create from scratch
3. Existing + Extras

phpcs.xml v 1.0
<?xml version="1.0"?>
<ruleset name="Super PSR12">
<description>PSR12 + Types</description>
<rule ref="PSR12" />
</ruleset>

phpcs.xml v 1.0
./vendor/bin/phpcbf --standard=phpcs.xml src tests

phpcs.xml v 1.0
if ($value) {
thing1();
}
if ($value2)
{
thing2();
}
if ($scott)
lookMomNoBraces();
if ($value) {
thing1();
}
if ($value2) {
thing2();
}
if ($scott) {
lookMomNoBraces();
}

–You (Maybe)
“How does this prevent bugs?”

Example
function add(int $a, int $b) {
return $a + $b;
}
// later
var_dump(add(1.25, 2.75)); // expect 4.00

1.25 + 2.75
(int)1.25 + (int)2.75
1 + 2
3

Fix
declare(strict_types=1);
function add(int $a, int $b) {
return $a + $b;
}
// later
var_dump(add(1.25, 2.75)); // expect 4.00

RequireStrictTypes
Fatal error: Uncaught TypeError: add(): Argument #1 ($a)
must be of type int, float given, called in
/home/user/scripts/code.php on line 9 and defined in
/home/user/scripts/code.php:5

phpcs.xml v 2.0
<ruleset name=“Super PSR+12">
<description> PSR12 + Types</description>
<rule ref=“PSR12" />
<rule ref="Generic.PHP.RequireStrictTypes" />
</ruleset>

phpcs.xml v 2.0
1 | ERROR | Missing required strict_types declaration

Slevomat Coding Standard
• Slevomat Coding Standard library
• composer require --dev "slevomat/coding-standard"

phpcs.xml v 2.0
<ruleset name=“Super PSR+12">
<description> PSR12 + Types</description>
<rule ref=“PSR12" />
<rule ref="Generic.PHP.RequireStrictTypes" />
<rule ref="SlevomatCodingStandard.TypeHints.PropertyTypeHint" />
<rule ref="SlevomatCodingStandard.TypeHints.ReturnTypeHint" />
<rule ref="SlevomatCodingStandard.TypeHints.ParameterTypeHint" />
</ruleset>

-Chris Tankersley
"Consistency provides comfortability"

Pipeline Review
Production
Change
Dynamic
Automated
Tests
Static
Lint
grep
phpcs

// User.php
class User
{
public int $id = 1;
}
// other.php
$user = new User();
echo $user->id;

// User.php
class User
{
private int $id = 1;
}
// other.php
$user = new User();
echo $user->id;

Fatal error: Uncaught Error: Cannot access private
property User::$id

PHPStan
• Finds bugs in our code
• “Oops you made a mistake here”
• Check “correctness” of each line

PHPStan: Setup
vendor/bin/phpstan analyse -l <number> src tests

PHPStan: Rule Levels
• Specify level of strictness using -l|--level parameter
• 0 -> Lowest Strictness
• 10 -> Highest Strictness

parameters:
ignoreErrors:
-
message: "#^Access to private property …::$id.$#”
count: 1
path: src/Location/User.php

PHPStan: Getting Started
1. Generate baseline at level 0
2. Fix all errors at current level
3. Increase level
4. Repeat until desired level

PHPStan
Production
Change
Dynamic
Automated
Tests
Static
Lint
phpcs
grep
PHPStan

PHP 7.4 To 8.0 Was
Challenging

Automating Refactoring
• Create a branch with PHP 8 installed
• Run through our tests
• Have someone manually fix the error

PHPStan: Setup
./vendor/bin/rector -dry-run

PHPStan: Setup
./vendor/bin/rector

Rector:rector.php
<?php
use RectorConfigRectorConfig;
return RectorConfig::configure()
->withPaths([
__DIR__ . '/scripts',
__DIR__ . '/src',
__DIR__ . '/tests',
])
// uncomment to reach your current PHP version
// ->withPhpSets()
->withTypeCoverageLevel(0)
->withDeadCodeLevel(0)
->withCodeQualityLevel(0);

Rector:rector.php
<?php
->withPaths([
__DIR__ . '/src',
__DIR__ . '/tests',
])
->withPhpSets()

Rector: example
Fatal error: Uncaught Error: Call to undefined function create_function()

Rector: example
vendor/bin/rector —dry-run

Rector: example
vendor/bin/rector

Rector:rector.php
<?php
->withPaths([
__DIR__ . '/src',
__DIR__ . '/tests',
])
->withPhpSets()

<?php
use RectorRenamingRectorClassConstFetchRenameClassConstFetchRector;
use RectorRenamingValueObjectRenameClassConstFetch;
->withConfiguredRule(RenameClassConstFetchRector::class, [
new RenameClassConstFetch(
‘DateTimeImmutable',
'NUMBER_OF_SECNDS_IN_AN_HOUR‘,
‘NUMBER_OF_SECONDS_IN_AN_HOUR'
),
]);

Production
Part 3: Code
Readability/Maintainability
Change
Dynamic
Automated
Tests
Static
Lint
phpcs PHPStan
grep Rector

What You Need to Know
Static Code Analysis allows us to analyze our code without running it

Process
Input(s) Output(s)

IDE
Test Server
Pre-Commit
F
a
s
t
e
r
F
e
e
d
b
a
c
k
M
o
r
e
S
a
f
e
t
y

• PHP Parallel Lint
• Grep
• PHP_CodeSniffer
• PHPStan
• Rector

Questions?
• Scott Keck-Warren
• Resources:
• https://tinyurl.com/sca-php-tek-2025

Reducing Bugs With Static Code Analysis php tek 2025

More Related Content

Similar to Reducing Bugs With Static Code Analysis php tek 2025

More from Scott Keck-Warren

Recently uploaded

Reducing Bugs With Static Code Analysis php tek 2025

Editor's Notes