PHPCS + PHPStan in CI (Workflow Guide)

Also Known As

TL;DR

Explanation

PHP_CodeSniffer (phpcs) enforces formatting rules — PSR-12 compliance, trailing whitespace, line length, brace placement. PHPStan catches logic and type errors that formatting tools miss — wrong return types, null dereferences, dead code. Run them as separate CI steps so failures are clearly attributed. Recommended CI pipeline: composer install → phpcs --standard=PSR12 src/ → phpstan analyse src/ --level=6 → phpunit. Use phpcbf (the fixer companion to phpcs) as a pre-commit hook so formatting issues never reach CI. Store PHPStan configuration in phpstan.neon, baseline in phpstan-baseline.neon for legacy code. Run both in parallel where CI supports it. Add psalm as a third layer for teams wanting maximum type safety coverage.

Common Misconception

Why It Matters

Common Mistakes

• Running tools only locally — developers skip them under pressure; CI enforces them for everyone.
• Starting PHPStan at level 0 and never increasing — it provides minimal value at the lowest level.
• Not using a baseline for legacy code — a fresh PHPStan run on old code produces thousands of errors; baseline incrementally.
• Fixing PHPCS warnings by suppressing them rather than correcting the code.

Code Examples

# CI pipeline without static analysis:
steps:
  - run: composer test    # Tests only — no style or type checking
  # No phpcs, no phpstan
  # Type errors and style violations merge undetected

# With quality gates:
steps:
  - run: vendor/bin/phpcs --standard=PSR12 src/
  - run: vendor/bin/phpstan analyse --level=8 src/
  - run: composer test

# CI workflow — code quality gates

# phpcs.xml
<?xml version="1.0"?>
<ruleset name="Project">
    <arg name="basepath" value="."/>
    <arg name="extensions" value="php"/>
    <rule ref="PSR12"/>
    <exclude-pattern>vendor/*</exclude-pattern>
    <exclude-pattern>database/migrations/*</exclude-pattern>
</ruleset>

# phpstan.neon
parameters:
    level: 6
    paths:
        - src
        - tests
    ignoreErrors:
        - '#Call to an undefined method Illuminate#'

# composer.json scripts
"ci": ["@lint", "@analyse", "@test", "@audit"]
"lint":    "phpcs"
"analyse": "phpstan analyse"

# .github/workflows/ci.yml
- run: composer lint
- run: composer analyse
- run: composer test

References

• ↗ https://phpstan.org/user-guide/getting-started
• ↗ https://github.com/squizlabs/PHP_CodeSniffer

Tags

Related Terms