Phpstan Laravel Package

Product Decisions This Supports

• Enhanced Code Quality & Developer Experience (DX):

  • Adopt static analysis for Laravel/PHP projects to catch bugs, enforce coding standards, and reduce runtime errors early in development.
  • Align with DevOps/SRE goals by integrating automated quality checks into CI/CD pipelines (e.g., GitHub Actions, GitLab CI).
  • Justify tooling investments by reducing technical debt and improving maintainability for long-term Laravel projects.

• Roadmap Prioritization:

  • Build vs. Buy: Avoid reinventing static analysis wheels—leverage this package (or alternatives like phpstan/phpstan) to standardize tooling across teams.
  • Scalability: Critical for teams with 50+ developers or projects with high complexity (e.g., monoliths, microservices with shared PHP/Laravel components).
  • Compliance/Standards: Meet internal or client requirements for PSR-12 compliance, type safety, or security audits.

• Use Cases:

  • Legacy Codebases: Identify and refactor risky or non-compliant code in large Laravel applications.
  • New Projects: Enforce consistency from day one by integrating phpstan into PR workflows.
  • Security: Detect potential vulnerabilities (e.g., SQL injection, XSS) via static analysis before deployment.

When to Consider This Package

• Adopt If:

  • Your team uses Laravel or PHP and lacks a dedicated static analysis tool.
  • You prioritize developer productivity and code reliability over short-term velocity.
  • Your organization is already invested in Ibexa DXP (this package is tightly coupled with it).
  • You need enterprise-grade support (via Ibexa’s BUL/TTL licenses) for large-scale deployments.

• Look Elsewhere If:

  • You’re not using Ibexa DXP: This package is not standalone—it requires Ibexa’s ecosystem. Consider phpstan/phpstan (more popular, 10K+ stars) or dealerdirect/phpcodesniffer for generic PHP/Laravel use.
  • Your team lacks PHPStan expertise: Requires configuration effort (e.g., tuning rules for Laravel’s DI container, Eloquent).
  • You need open-source/free licensing: Ibexa’s BUL/TTL licenses are not permissive (e.g., incompatible with MIT/GPL projects).
  • Your project is small/simple: Overhead may not justify benefits for trivial codebases.

How to Pitch It (Stakeholders)

For Executives:

"This package lets us automate code quality checks for our Laravel applications, catching bugs and security issues before they reach production. Think of it like a ‘spellcheck’ for PHP—saving time on debugging and reducing costly outages. For $X in licensing (if using Ibexa DXP), we get enterprise-grade static analysis that scales with our team. Competitors like PHPStan are free but lack Ibexa’s integration and support. This is a low-risk, high-reward investment to future-proof our codebase."

For Engineering:

*"We’re adding PHPStan to our toolchain to:

1. Catch type errors and undefined methods early (e.g., Method [foo] does not exist).
2. Enforce PSR-12 and Laravel best practices via custom rules.
3. Integrate with CI to block broken PRs (e.g., fail builds on new errors). Pros: Faster debugging, fewer runtime surprises. Cons: Initial setup (~2–4 hours for Laravel-specific rules). Let’s pilot it on [Project X] first."*

For Developers:

*"PHPStan will flag potential bugs in your code before you even run tests. For example:

• Did you forget to check if a variable is null?
• Are you calling a method that doesn’t exist?
• Is your Eloquent query safe from SQL injection? It’s like a linter for PHP, but smarter. We’ll configure it for Laravel’s quirks (e.g., Facades, Service Providers) and run it locally + in CI. Try it on your branch—it’ll save you hours of ‘works on my machine’ headaches."