Weave Code
Psalm Laravel Package
vimeo/psalm
Psalm is a PHP static analysis tool that finds type errors, dead code, and risky patterns before runtime. Add it to your CI to improve code quality, enforce stricter typing, and catch bugs early in applications and libraries.
A PHP static analysis tool for finding errors and security vulnerabilities in PHP applications
Frequently asked questions about Psalm
- How do I integrate Psalm into a Laravel project’s CI/CD pipeline?
- Psalm integrates via CLI commands in your CI workflow (e.g., GitHub Actions). Run `psalm --init` to generate a `psalm.xml` config, then add a step like `composer exec psalm --no-cache` to analyze code. For parallel processing in monorepos, use the `--workers` flag to speed up analysis.
- Will Psalm work with Laravel’s magic methods (e.g., `__get`, `__set`) without false positives?
- Psalm may flag Laravel’s magic methods as errors by default. Mitigate this by configuring `psalm.xml` to ignore specific files or classes using `<ignore-files>` or `<ignore-classes>`. For dynamic properties, use `@psalm-suppress` annotations or custom stub files.
- Can Psalm replace PHPStan in a Laravel project, or should they run together?
- Psalm and PHPStan serve complementary roles. Psalm excels at fine-grained type inference and security analysis (e.g., taint tracking), while PHPStan focuses on broader type checking. Running both in CI provides deeper coverage, but start with Psalm’s stricter rules for critical projects.
- How do I configure Psalm to ignore Laravel’s vendor or storage directories?
- Edit `psalm.xml` and add `<ignore-files>` tags for paths like `vendor/`, `storage/`, or `bootstrap/cache/`. For multi-project setups, use `psalm-discover.xml` to exclude directories dynamically. Example: `<ignore-files>vendor/.*</ignore-files>`.
- Does Psalm support Laravel’s Eloquent ORM and Blade templates?
- Psalm can analyze Eloquent queries and Blade templates if you provide stub files. For Eloquent, generate stubs with `psalm --generate-stubs` or manually define them. For Blade, use the `@mixin` or `@template` annotations in your template files to guide type checking.
- What PHP and Laravel versions does Psalm support?
- Psalm supports PHP 8.0+ (Laravel’s LTS versions) and works with any composer-based Laravel project. For Laravel 9+ (PHP 8.1+), Psalm’s enhanced type system (e.g., union types, attributes) aligns well with modern Laravel features like typed route parameters.
- How can I reduce Psalm’s analysis time in CI for large Laravel projects?
- Use incremental analysis by caching results with `--cache-globals` or `--cache-dir`. For monorepos, enable parallel workers (`--workers=4`) to distribute the load. Avoid `--no-cache` in CI unless debugging; instead, clear the cache selectively with `psalm --clear-cache`.
- Are there Psalm plugins for Laravel-specific features like validation or queues?
- Psalm’s plugin API (v7.0+) allows custom rules for Laravel. While no official plugins exist yet, you can create one to validate Eloquent queries, Form Requests, or Queue jobs. Check the [Psalm docs](https://psalm.dev/docs/plugins) for guidance on building plugins.
- How do I handle Psalm’s false positives in Laravel’s dynamic code (e.g., service containers)?
- Suppress false positives with `@psalm-suppress` annotations (e.g., `@psalm-suppress MixedReturnStatement`). For service containers, use `@psalm-internal` or `@psalm-pure` annotations to mark safe methods. If issues persist, adjust `psalm.xml` to relax type checks for specific classes.
- Can Psalm be used alongside Laravel Pint or PHP-CS-Fixer in CI?
- Yes. Psalm focuses on static analysis (type safety, security), while Pint/CS-Fixer handle code style. Run them sequentially in CI: first Psalm for errors, then Pint/CS-Fixer for formatting. Example workflow: `composer exec psalm && composer exec pint`.
Weaver
How can I help you explore Laravel packages today?