Weave Code
Php Static Analysis Laravel Package
etsglobal/php-static-analysis
A PHP static analysis package from ETS Global for inspecting PHP codebases and supporting code quality workflows. Integrates into Laravel/PHP projects to help surface potential issues, encourage cleaner code, and complement existing test and CI pipelines with additional static checks.
Static analysis tools configuration for PHP projects
Frequently asked questions about Php Static Analysis
- What is etsglobal/php-static-analysis and what does it actually ship?
- It is a require-dev-only Composer package from ETS Global that ships static analysis tool configuration, in the style of PHPStan, Psalm, or PHP-CS-Fixer presets, rather than runtime code for your application. Its architectural coupling to a Laravel app is effectively zero, which is its main strength. Before adopting it, confirm whether it contains only config files or also wrapper binaries and scripts, since that changes the risk profile.
- How do I install etsglobal/php-static-analysis in a Laravel project?
- Install it as a dev dependency with composer require --dev etsglobal/php-static-analysis so it never lands in the require block or in production images. Check the package's own composer.json to confirm it cleanly separates dev concerns and does not touch autoloading for runtime code. If it cannot be kept out of production builds, treat that as disqualifying.
- Does etsglobal/php-static-analysis work with Larastan?
- Compatibility is contingent on the preset not fighting Larastan, which is the de facto Laravel-aware PHPStan extension. An opinionated preset that hardcodes the PHPStan level, analysis paths, or stub sets can silently override Larastan's bootstrap and generate noise around facades, Eloquent magic, and container bindings. Verify this in a throwaway branch before any pilot.
- Which PHP and Laravel versions does this package support?
- The package does not advertise a clear PHP or Laravel support matrix, so you must validate it against your own version matrix first. Config packages often lag PHP minor releases because the underlying analysers do, and PHPStan's 1.x to 2.x transition changed the config surface materially. Check the last commit date, since commit recency is the only health proxy when adoption signals are absent.
- Will it conflict with my existing PHPStan or PHP-CS-Fixer version?
- This is the dominant technical risk: a config package that pins phpstan/phpstan or php-cs-fixer to a specific major version can block your own tooling and security upgrades. Inspect the exact version constraints it declares rather than assuming caret ranges are harmless. If you do adopt it, pin it exactly and avoid letting it constrain the analyser itself.
- Can I override the preset rules, paths, or ignore-errors settings?
- It is unclear from the overview whether the preset is monolithic or allows overriding level, paths, and ignore-errors. Test this early by trying to set your own level and ignore-errors on top of the included config. There is also a silent drift risk if the preset is loaded via includes, because upstream rule changes can land in your CI without any corresponding change in your repository.
- Is etsglobal/php-static-analysis maintained and widely used?
- There are no observable adoption signals: zero stars, zero dependents, and no evidence of it running on codebases beyond its author's. Confirm the license and whether ETS Global is committing to maintenance or this is a public mirror of an internal file. With no community usage to lean on, treat maintenance risk as high until proven otherwise.
- How should I pilot this package before adopting it?
- Start by diffing its config against a hand-rolled phpstan.neon.dist to see whether the delta is non-trivial. Run it on a branch alongside Larastan at your current PHPStan level and compare the reported issues. If you keep a live dependency, pin it exactly and add a scheduled job that surfaces upstream config diffs as a pull request instead of auto-updating.
- Should I use this package or just write my own phpstan.neon.dist?
- For a config-only package with no adoption signals, the safer path is to copy the preset files into your repository as a one-time starting template, attribute the source, and own them from then on. That captures the package's real value, the opinions about rules, without the abandonment, version-pin, and silent-drift risks. Only take a live Composer dependency if it ships logic you cannot replicate, such as custom rules, a ruleset generator, or maintained stub libraries.
- What alternatives exist for static analysis in a Laravel project?
- The standard stack is Larastan on top of PHPStan for Laravel-aware analysis, plus Pint or PHP-CS-Fixer for style and optionally Psalm for a second opinion. These are actively maintained and give you direct control over levels, baselines, and ignore-errors. A third-party preset is only additive if it composes with that stack rather than substituting for it.
Weaver
How can I help you explore Laravel packages today?