Static Analysis Laravel Package

Product Decisions This Supports

• Enhancing Code Quality & Developer Experience:

  • Integrate static analysis into CI/CD pipelines to catch bugs, enforce coding standards, and reduce runtime errors early.
  • Align with PHP/PSR standards (e.g., PSR-12) by automating compliance checks, reducing manual reviews.
  • Enable developer self-service by embedding analysis into IDEs (e.g., PHPStorm) for real-time feedback.

• Roadmap Prioritization:

  • Build vs. Buy: Avoid reinventing static analysis tools; leverage this package to reduce maintenance overhead while gaining enterprise-grade validation.
  • Scalability: Ideal for monorepos or large codebases where manual analysis is unsustainable.
  • Security & Compliance: Use as part of a pre-commit hook or gated PR workflow to block vulnerable patterns (e.g., SQLi, XSS).

• Use Cases:

  • Open-Source Projects: Enforce consistency across contributors.
  • Legacy Codebases: Identify dead code, type mismatches, or deprecated APIs.
  • Microservices: Validate inter-service contracts (e.g., API responses, request payloads).

When to Consider This Package

• Adopt if:

  • Your team uses Laravel/PHP and lacks a dedicated static analysis tool.
  • You prioritize developer productivity over custom tooling (low setup effort).
  • Your project has moderate-to-high complexity (e.g., >5K LOC) where manual reviews are error-prone.
  • You’re already using Psalm or want to adopt it without managing dependencies manually.

• Look elsewhere if:

  • You need custom rule sets beyond Psalm’s defaults (e.g., domain-specific logic).
  • Your stack includes non-PHP languages requiring multi-language analysis (e.g., TypeScript, Go).
  • You’re constrained by legacy systems incompatible with Psalm’s strict typing.
  • You require real-time collaboration tools (e.g., GitHub Advanced Security) over CLI-based analysis.

How to Pitch It (Stakeholders)

For Executives: *"This package lets us automate 80% of code quality checks with minimal effort—reducing bugs in production by catching type errors, unused code, and security flaws before they reach QA. It’s like hiring a 24/7 junior developer to review PRs, but for a fraction of the cost. For a one-time composer require, we get:

• Faster releases (fewer last-minute fixes).
• Lower technical debt (Psalm’s baseline tracking).
• Consistency across teams (enforced standards). No upfront cost; ROI comes from saved dev hours and fewer critical bugs."

For Engineering: *"This is a drop-in static analysis suite for PHP/Laravel that:

• Integrates with Psalm (industry-standard tool) without dependency hell.
• Zero config for basic use (just add psalm.xml).
• Plays nice with CI (e.g., fail builds on errors, or gate PRs). Perfect for teams that want strict typing but don’t want to manage tools like PHPStan or Infection separately. Start with composer require innmind/static-analysis and iterate from there."