Phpstan Strict Rules Laravel Package

Getting Started

Start by installing the package as a dev dependency:

composer require --dev phpstan/phpstan-strict-rules

If you use phpstan/extension-installer, it auto-loads. Otherwise, manually include vendor/phpstan/phpstan-strict-rules/rules.neon in your phpstan.neon. Run PHPStan—no configuration needed to begin catching common anti-patterns like loose comparisons (==, !=), empty(), or short ternaries (?:). First use case: upgrade an existing codebase incrementally by enabling only disallowedLooseComparison and disallowedEmpty to surface explicit bugs.

Implementation Patterns

• Gradual adoption: Set strictRules.allRules: false and enable rules one-by-one via config (e.g., booleansInConditions: true) to avoid breaking CI during migration.
• Targeted linting: Configure rules like strictFunctionCalls to enforce in_array(..., ..., true) and base64_decode(..., false) to prevent type coercion bugs in data validation.
• Strict typing discipline: Combine with declare(strict_types=1) and PHPStan’s core level to get reliable type inference; rules like numericOperandsInArithmeticOperators prevent accidental string arithmetic (e.g., "5" + 3).
• Pre-commit hook: Integrate into a pre-commit or CI pipeline with vendor/bin/phpstan analyse --level=max. Use phpstan.neon to ignore specific errors only with inline @phpstan-ignore-next-line or @phpstan-ignore-line.

Gotchas and Tips

• False positives on dynamic code: Rules like noVariableVariables and closureUsesThis can conflict with meta-programming patterns (e.g., Laravel’s magic methods or Symfony’s ExpressionLanguage). Disable selectively or refactor to explicit calls.
• Overly strict LSP enforcement: requireParentConstructorCall and LSP checks may fail on legacy abstract classes where parent constructors are unused—suppress with @phpstan-method annotations or explicit parent::__construct() stubs.
• Case-sensitivity traps: WrongCaseOfInheritedMethodNames is unforgiving across OS boundaries; ensure consistent naming in file/class/method names (e.g., UserController vs userController.php).
• Configuration leakage: Some core PHPStan defaults (e.g., checkAlwaysTrueInstanceof) are upgraded by the package. To revert, explicitly set them false in parameters: section.
• Debug tip: Run vendor/bin/phpstan debug with -c phpstan.neon to inspect which rules fired and why; use --Debug for deeper insights into rule matching.