Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add PHPStan analysis, level 5 #195

Merged
merged 12 commits into from
Jan 25, 2025
Merged

Conversation

spaze
Copy link
Contributor

@spaze spaze commented Jan 24, 2025

Bugs and deprecations like the one fixed in #194 should be caught by static analysis (running in CI), but unfortunately Psalm is lagging behind and it doesn't support PHP 8.4 yet vimeo/psalm#11107

This adds PHPStan, another static analyzer that seems to be (more) actively developed, and runs it in CI for all supported versions, while Psalm can only be run on 8.3 max. The PR doesn't replace Psalm just yet.

I've tried fixing most of the bugs reported on PHPStan level 5 (out of 10), and have added the rest, which I consider "errors caused by defensive programming" to the baseline file, as I don't want to remove the defensive runtime checks, at least not now.

I haven't refactored the code in any significant way, although for example the class alias in

class_alias('ParagonIE\HiddenString\HiddenString', 'ParagonIE\\Halite\\HiddenString');

could be removed and the Halite's HiddenString replaced with the class from the extra package as Halite's major version has changed since the change was introduced, see #124 for details.

Please consider the PHPStan "move" a WIP/PoC thing at the moment, but the PR can be merged of course. I can work on getting PHPStan checks to higher levels but wanted to check first whether adding PHPStan (or replacing Psalm with PHPStan) is something you'd like to go with.

@paragonie-security paragonie-security merged commit b745ae4 into paragonie:master Jan 25, 2025
5 checks passed
@spaze spaze deleted the spaze/phpstan branch January 25, 2025 19:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants