Infection Static Analysis Plugin Laravel Package

Product Decisions This Supports

• Enhancing Code Quality & Test Coverage:

  • Justify investment in mutation testing as a critical component of CI/CD pipelines, particularly for PHP projects leveraging static typing (Psalm/PHPStan).
  • Align with shift-left testing initiatives by integrating stricter validation into the development workflow, reducing runtime errors and improving maintainability.

• Build vs. Buy Decision:

  • Buy: Avoid reinventing mutation testing + static analysis integration. This package provides a pre-built solution for a niche but high-value problem (escaping type-violating mutants).
  • Custom Build: Only consider if the team requires multi-tool support (e.g., PHPStan + Psalm + custom analyzers) beyond Psalm’s current scope, or if performance bottlenecks cannot be mitigated.

• Roadmap Priorities:

  • Phase 1: Pilot in high-risk modules (e.g., payment processing, data validation) where type safety is critical.
  • Phase 2: Expand to core libraries post-validation, with a focus on reducing false positives in mutation reports.
  • Phase 3: Advocate for native plugin support in infection/infection to reduce maintenance overhead (long-term dependency risk).

• Use Cases:

  • Type-Safe PHP Projects: Teams using Psalm/PHPStan to enforce strict typing, where escaped mutants (e.g., type violations) currently inflate mutation scores artificially.
  • Legacy Code Modernization: Identify hidden type inconsistencies in untyped or loosely typed codebases during migration to static analysis.
  • CI/CD Optimization: Replace manual static analysis + mutation testing runs with a single, integrated pass, reducing pipeline complexity.

When to Consider This Package

Adopt This Package If:

• Your team already uses:
  • Mutation testing (infection/infection) and static analysis (Psalm/PHPStan).
  • PHP 8.1+ (current compatibility range: 8.1–8.5).
  • A CI/CD pipeline where test speed is a secondary concern to accuracy (this tool is ~2–3x slower than vanilla Infection).
• You prioritize:
  • Type safety over raw mutation score metrics.
  • Reducing flaky tests caused by type-violating mutants.
  • Developer productivity by catching edge cases early (e.g., array_values → array return type mutations).
• You’re willing to:
  • Pin infection/infection to a specific version (avoid breaking changes).
  • Accept maintenance overhead until native plugin support is added.

Look Elsewhere If:

• Your project does not use static typing (Psalm/PHPStan) or mutation testing.
• Performance is critical: This tool’s overhead may not justify the gains for fast-moving teams.
• You need multi-tool support (e.g., PHPStan + custom analyzers) beyond Psalm’s current scope.
• Your team lacks CI/CD flexibility to accommodate slower test runs (e.g., strict time budgets).
• You’re using PHP < 8.1 or > 8.5 (as of 2026-05-15).

How to Pitch It (Stakeholders)

For Executives:

*"This tool closes a critical gap in our PHP code quality pipeline. Today, mutation testing catches bugs by introducing small code changes—but it often misses type violations that static analyzers like Psalm flag. By integrating these two processes, we’ll:

• Catch more bugs earlier, reducing production incidents tied to type errors.
• Improve test reliability by eliminating false positives from escaped mutants.
• Future-proof our tech stack with stricter typing, a key differentiator for maintainability. The tradeoff? A ~2–3x slowdown in mutation tests (mitigated by running only in CI). For high-risk modules, this is a no-brainer."*

Ask for:

• Budget for CI/CD adjustments (e.g., parallelizing static analysis).
• Approval to pilot in 1–2 critical services before full rollout.

For Engineering Teams:

*"We’re adding a plugin to Infection that runs Psalm on mutated code. Why?

• Problem: Mutation tests often ‘escape’ type violations (e.g., returning array instead of list<T>), inflating our mutation score artificially.
• Solution: This tool kills mutants that break type contracts, so we write fewer redundant tests and catch real bugs faster.
• How it works:
  1. Replace vendor/bin/infection with vendor/bin/roave-infection-static-analysis-plugin.
  2. Point it to your psalm.xml config (or default to Psalm’s rules).
  3. Mutants violating types are auto-killed.
• Tradeoffs:
  • Slower (~2–3x) than vanilla Infection (but only runs in CI).
  • Requires pinning infection/infection to a specific version (temporary).
• Next steps: Let’s test this in the payments module first—it’s type-heavy and bug-prone."*

Ask for:

• DevOps buy-in to adjust CI timeouts.
• QA feedback on false positives/negatives in pilot phase.
• Architecture review to ensure compatibility with existing tooling (e.g., GitHub Actions).