Weave Code
Infection Static Analysis Plugin Laravel Package
roave/infection-static-analysis-plugin
Runs Psalm static analysis on escaped mutants from Infection test runs, killing mutations that violate your program's type signatures. Improves mutation scores by removing false escapes. Acts as a drop-in replacement for vendor/bin/infection with an extra --psalm-config flag. Note: hacky and slower...
roave/infection-static-analysis-plugin is a static analysis layer for infection/infection mutation testing. After Infection generates escaped mutants, the plugin runs Psalm against each one: mutations that violate your program's type signature are treated as killed, giving a more accurate mutation score. It replaces the usual vendor/bin/infection entry point and runs all standard Infection flags plus an optional --psalm-config argument.
- Runs static analysis over escaped mutants to reject type-invalid mutations
- Drop-in binary:
vendor/bin/roave-infection-static-analysis-plugin - Supports custom Psalm configuration via
--psalm-config - Raises mutation scores by killing mutants that would not type-check
- Experimental and slower than plain Infection, so review its stability notes first
Frequently asked questions about Infection Static Analysis Plugin
- What does roave/infection-static-analysis-plugin actually do?
- It runs Psalm over the escaped mutants that Infection generated but your tests failed to kill. If a mutant would produce a type error, the plugin marks it as killed instead of escaped, so your mutation score goes up and mutants that were never valid code stop polluting the report. In practice it removes false negatives where mutation testing flags a mutation that could not have worked anyway.
- How do I install roave/infection-static-analysis-plugin in a Laravel application?
- Run composer require --dev roave/infection-static-analysis-plugin. It is a dev-only Composer binary with no service provider, no facade and no publishable config, so nothing in your application bootstrap changes. You also need Psalm (^4 or ^5) and the infection/infection version the plugin release is pinned to, both as dev dependencies.
- Does the plugin replace vendor/bin/infection, and how do I run it?
- Yes, the design is that you execute vendor/bin/roave-infection-static-analysis-plugin instead of vendor/bin/infection. The plugin accepts all Infection flags and arguments plus an extra --psalm-config option, for example --psalm-config config/psalm.xml. Because the binary name changes, update your Composer scripts and CI jobs so developers and pipelines call the right command.
- Does it work with PHPStan and Larastan, or only with Psalm?
- Only Psalm is supported today, with the maintainers describing Psalm support as the initial 1.0.x scope of work and no PHPStan adapter present in the package. Most Laravel teams standardise on PHPStan with Larastan, so adopting this tool usually means adding a second static analyser and maintaining a Psalm config just for mutation runs. That duplicate configuration and CI cost is the main adoption question to answer before you start.
- Which PHP and Laravel versions are supported?
- The plugin requires PHP 8.1 or newer: PHP 8.0 support was dropped in 1.26.0, while PHP 8.2 support arrived in 1.23.0 and PHP 8.3 in 1.33.0. It is not a Laravel package, so there is no Laravel version constraint beyond your PHP version, meaning Laravel 10 on PHP 8.1+ and Laravel 11 on PHP 8.2+ are fine. You also need Psalm ^4 or ^5 and the specific infection/infection release the plugin version is pinned against.
- Does it work with Pest, or only PHPUnit?
- Test-runner support comes entirely from the underlying Infection version the plugin is pinned to, so it inherits whatever Infection supports rather than adding anything itself. Check that pinned Infection release against your Pest or PHPUnit version before wiring it into CI, especially on Pest 2 or Pest 3. If the pinned Infection version does not support your runner, the plugin will not work regardless of how it is configured.
- Why is mutation testing so much slower with this plugin?
- The README states plainly that it is currently much slower than running Infection by itself, because every escaped mutant gets an additional static analysis pass. Recent work such as PR #196 reduced the cost by reloading only the mutated code instead of re-analysing the whole codebase, but the overhead is still measurable. A common pattern is running the plugin nightly and plain Infection on pull requests, so the extra wall-clock does not hit every push.
- Is it safe to use in production, and does it add runtime dependencies?
- It is strictly developer tooling: install it with --dev, and it ships no service provider, no runtime code path and no container bindings. It only ever executes from vendor/bin during local verification or CI, so all architectural risk stays at build time. Keep it out of the require section and out of any production autoload build to avoid shipping it with your application.
- How stable is it, and will it break when Infection releases a new version?
- The package is explicitly described as hacky, because Infection has no plugin API and the plugin bootstraps itself aggressively while relying on internal details of the runner. It pins to a very specific Infection version, so every Infection upgrade becomes a coordinated upgrade with the plugin and CI can break if Infection is bumped first. Treat that upgrade cadence as an owned responsibility rather than letting Renovate or Dependabot merge either side blindly.
- Should I use this instead of plain Infection, or stick with my current setup?
- Use it if you already run Psalm, want escaped mutants that are type errors to be killed, and can absorb the extra runtime. If your team is PHPStan and Larastan only, or mutation runs are already the slowest job in CI, plain Infection with strong type coverage is usually the better trade. Pilot it alongside your existing Infection job first and compare both the mutation score delta and the runtime multiplier before replacing anything.
Weaver
How can I help you explore Laravel packages today?