- What is kphoen/rusty and what does it actually do?
- Rusty implements the documentation-as-tests pattern for PHP, inspired by Rust's doctests. It extracts executable code samples from docblocks and runs them as part of your test suite, so examples that drift out of sync with the implementation fail CI. It lives entirely at the test layer and adds no production runtime dependency to a Laravel application.
- How do I install and configure Rusty in a Laravel project?
- Install it as a dev dependency with composer require --dev kphoen/rusty, then point a PHPUnit test case or test suite at the source directories you want scanned. Because the package is archived, pin the exact version you validate and expect to patch it for your PHPUnit major. Start with one small directory of well-behaved examples to confirm the harness works before rolling it out across the codebase.
- Does Rusty support Laravel 11, PHP 8.3 and PHPUnit 11?
- Assume breakage: the package was written before PHPUnit 10 and 11 changed test metadata, lifecycle and result APIs, so a Laravel 10 or 11 project on PHP 8.2+ with PHPUnit 10/11 will almost certainly need patching. Check the last release's Composer constraints for the PHP and PHPUnit ranges it actually claims, then run a short discovery spike to measure the fork delta. Do not treat it as a drop-in on modern stacks.
- How does Rusty hook into PHPUnit: custom TestCase, test suite, listener or extension?
- The integration surface is intentionally small, a test harness plus a docblock parser, and it is expected to work through a PHPUnit test case or suite that you point at source directories. Confirm the exact mechanism before estimating fork cost, because a listener or extension hook means rewriting against the newer PHPUnit APIs, while a custom TestCase-based hook is the cheapest thing to port. This one question largely determines whether a fork is a day or a week of work.
- Are documentation examples isolated, or do they all share one PHPUnit process?
- This matters more than it sounds: examples that touch time, IO or framework bootstrapping become brittle if they share state inside a single PHPUnit process. Verify whether each example runs in a fresh process or shares the runner, and keep examples deterministic with no wall-clock, network or database access unless you can control it. If isolation is missing, run the extracted examples through a subprocess wrapper you own.
- Is it safe to execute code embedded in docblocks in CI?
- Running code from comments is a deliberate feature of the package, which means documentation content becomes executable input. That is acceptable inside CI with code review, but it must never run against untrusted branches, contributor-supplied docblocks or generated documentation without gating. Treat the doctest step like any other code execution step and restrict it to trusted pipelines.
- Can I use Rusty with Pest instead of PHPUnit?
- Rusty predates Pest and has no first-class Pest support, so a Pest-based project needs an adapter or a bridge test case. The pragmatic route is a Pest dataset that feeds extracted examples into generated tests, or keeping a small isolated PHPUnit suite dedicated to doctests. Either way, you own the glue code and should budget for it.
- Is kphoen/rusty still maintained and safe to depend on?
- No. The repository is archived, has roughly 47 stars and zero dependents, which makes it a single-author reference implementation rather than an ecosystem-standard tool. Archival means no fixes for PHP minor-version drift or PHPUnit API churn, and there is no support path. Fork and vendor it as a pinned first-party dev dependency, or use it purely as a design reference.
- What alternatives exist for doctesting PHP, and should I fork Rusty or build my own?
- If PHPStan is already in your stack, phpstan/phpstan-doctest covers the same need with a much lower total cost of ownership and no fork to maintain. Otherwise an internal equivalent is realistic: a Pest dataset or PHPUnit data provider that scans configured directories, extracts fenced examples, writes them to a temp test file and runs them in a subprocess is roughly 150 to 250 lines you fully own. Decide based on whether the real goal is documentation accuracy, onboarding examples or API contract verification.
- What transitive dependencies does Rusty pull in and what is the CVE exposure?
- Docblock parsing typically pulls phpdocumentor/reflection-docblock and related packages, so you inherit their CVE exposure with no upgrade path from the original author. Inspect composer.lock after installing and make sure your security scanning covers dev dependencies, not just production ones. If that exposure or the lack of a maintainer is unacceptable, the internal build route gives you control over the parser dependency.