Running PHPStan in CI

Run PHPStan after installing locked dependencies in CI so type regressions fail the build before deployment.

What It Does

Run static analysis on every change using a pinned PHP version and locked dependencies. Run the locally installed analyzer against application source.

Requirements and Compatibility

Use a supported PHP runtime and install any third-party tool or extension explicitly shown in the examples. Commands should be run from the project root unless stated otherwise.

Syntax, Inputs and Results

The examples separate configuration, the smallest working operation and a realistic follow-up task. Adapt file paths and dependency versions to your own project.

Example 1: Basic Use

Run static analysis on every change using a pinned PHP version and locked dependencies.

name: Static Analysis
on: [push, pull_request]
jobs:
  phpstan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: shivammathur/setup-php@v2
        with: {php-version: '8.4'}
      - run: composer install --no-interaction --prefer-dist
      - run: vendor/bin/phpstan analyse --no-progress

Example 2: Another Case

Run the locally installed analyzer against application source.

composer require --dev phpstan/phpstan
vendor/bin/phpstan analyse src --level=max --no-progress
vendor/bin/phpstan analyse --error-format=github

Practical Example

Start with explicit analysis paths and a strictness level appropriate for the codebase.

parameters:
  level: 6
  paths:
    - src
  tmpDir: build/phpstan

For production, apply the compatibility and edge-case limits described below.

Important Behavior and Edge Cases

A green analysis does not replace runtime tests or prove business logic.

Comparison with Related Functions and Tools

Subject	Key difference
Static analysis vs runtime tests	PHPStan checks source types without executing business behavior; tests confirm actual outcomes.

Common Beginner Mistakes

Mistake	Correct approach
Ignoring unknown or mixed types	Add valid PHPDoc element types or proper native declarations, then re-run the analyzer.
Skipping the prerequisite of this specific workflow	Install or configure the named tool and confirm the example can actually run.
Ignoring edge conditions	A green analysis does not replace runtime tests or prove business logic.

Key Takeaways

Run PHPStan after installing locked dependencies in CI so type regressions fail the build before deployment.
A green analysis does not replace runtime tests or prove business logic.
Keep application configuration, source code and validation tests under version control.

Use these examples as a starting point, then validate the result with the actual PHP build, dependencies and inputs used by your application.