Static Code Analysis PHP[tek] 2023

Reducing Bugs With Static Code
Analysis
Scott Keck-Warren
php[tek] 2023
@scottKeckWarren@phpc.social
@scottKeckWarren@twitter.com

How We Fixed Bugs (Don’t Do This)
1. Duplicate the bug
2. Fix it
3. Open SFTP connection to production
4. Manually edit the file
5. Cross our fingers nothing broke

What Happened?
Parse error: syntax error, unexpected identifier "privte",
expecting "function" or "const"

What Happened?
Fatal error: Uncaught Error:
Call to undefined method User::getId()

What Happened?
• Type errors
• Left over `echo` debug statements
• `exit` in unexpected spot

What’s the Fix?
Production
Change

What’s the Fix?
Production
Change
?

Scott Keck-Warren
Director of Technology
@ WeCare Connect

Scott Keck-Warren
PHP Developer

Scott Keck-Warren
Host
@ PHP[Architect] YouTube
Channel

https://www.youtube.com/c/phparch

Agenda
1. What is Static Code Analysis?
2. Where Do We Perform Static Code Analysis?
3. Tools For Static Code Analysis

What is Static Code Analysis?
Two Ways to Analyze Code
1. Dynamic Code Analysis
2. Static Code Analysis

Dynamic Code Analysis
• Run code (manually or automatically)
• Manual: slow and expensive
• Automated: slow to create but infinitely repeatable

Static Code Analysis
• Analyze our source code without actually executing
• Slow onboarding (maybe) on brownfield applications
• Infinitely repeatable
• Can be faster than dynamic tests

What specifically can we do with Static Code Analysis?
• Find errors
• Adhere to standards
• Automatically refactor our code

• Teams size is not a limiting factor to using SCA
• Compute can be

Where Do We Perform Static
Code Analysis?

Feedback Loops
Process
Input(s)

Feedback Loops
Process
Input(s) Output(s)

Feedback Loops:Worst Case
Process
Input(s)
Output(s
)

Feedback Loops:Worst Case
• Change is made
• Change is pushed to production
• Problem found a month later
• Problem is completely divorced from original
change
• Leaders to Confusion
• What caused this?
Process
Input(s)
Output(s
)

Feedback Loops:Okay Case
• Change is made on own branch
• Change is heavily tested on testing server
• Problem found during testing
• Problem solved quick because change is
still fresh in our mind
Process
Input(s)
Output(s
)

Feedback Loops:Better Case
• Change is made on own branch
• Change is heavily tested locally
• Problem found before code leaves our
computer
• Problem solved quicker but still delayed
Process
Input(s)
Output(s
)

Feedback Loops:Best Case
• Change is made on a file
• Changes are tested as we type/save
• Problem found immediately
• Problem solved immediately
Process
Input(s)
Output(s
)

Where Do We Run Static Code Analysis?
Best
Okay
Better

Best
Test Server
Better

Test Server
• Goal: Going to give us secure base
• All tools run
• All files
• Slow
Best
Test Server
Better

Test Server
• Lots of options for this
• Quickly talk about GitHub Actions
• Quick to setup
• “Infinitely” scaleable
Best
Test Server
Better

Test Server
• Two ways to setup
• One Job For All Tools
• Tools Run In Series
• Multiple Jobs/Actions For Each Tool
• Tools Run in Parallel
Best
Test Server
Better

Large Project Actions
Production
Change

Production
Change
Dynamic
Automated
Tests

Production
Change
Dynamic
Automated
Tests
Static

Best
Test Server
Pre-Commit

Before Commit Is Created
• Build off secure base
• Balance of tools
• Changed files only
• Faster
Best
Test Server
Pre-Commit

Before Commit Is Created: How?
• Run files manually
• Copy and paste each file
• Skip this step SO fast
Best
Test Server
Pre-Commit

Before Commit Is Created: How?
• Run files automatically
• Use pre-commit functionality
Best
Test Server
Pre-Commit

Pre-Commit Script
git add .
git commit -m “changes”
Commit Created

Pre-Commit Script
git add .
git commit -m “changes”
Commit Created
Pre-commit
Denied

Pre-Commit Script
Our Pre-commit script’s goals:
1. Give us fast feedback loop
2. Only run on files we changed
3. Run as many tools as possible

Pre-Commit Script
git diff
—diff-filter=AM
—name-only
—cached
app tests | grep ".php$"

Pre-Commit Script
function __runStaticTool() #(name, command)
{
echo -e "nn$1"
output=$(eval "$2" 2>&1)
exitcode=$?
if [[ 0 == $exitcode || 130 == $exitcode ]]; then
echo -e "Success"
else
echo -e "Failurenn$output"
exit 1
fi
}

Pre-Commit Script
#!/usr/bin/env bash
{
...
}
modified="git diff --diff-filter=AM --name-only --cached app tests | grep ".php$""
__runStaticTools "PHP_CodeSniffer" "${modified} | xargs vendor/bin/phpcs --standard=PSR12

Pre-Commit Script
#!/usr/bin/env bash
{
...
}
modified="git diff --diff-filter=AM --name-only --cached app tests | grep ".php$""
__runStaticTools "PHP_CodeSniffer" "${modified} | xargs vendor/bin/phpcs --standard=PSR12
__runStaticTools "phpstan" "${modified} | xargs vendor/bin/phpstan analyze

Pre-Commit Script
• Located at .git/hooks/pre-commit
• NOT part of repo
• Can be skipped

Pre-Commit Script
• Keep copy in “scripts” directory
• Use composer to install everywhere

IDE
Test Server
Pre-Commit

IDE
• Build off secure base
• Smaller Number of tools
• Changed files
• Immediate feedback
IDE
Test Server
Pre-Commit

IDE: Top Suggestions
• Errors out in public
• Don’t ignore them
• Look for integrations/extensions

https://github.com/exakat/php-static-analysis-tools
https://github.com/exakat/php-static-analysis-tools

https://analysis-tools.dev/tag/php

Types of SCA Tools
1. Bug Reduction
2. Rule Validation
3. Code Analysis

Focus: Scott’s Favorites
1. Free
2. Easy to use
3. Command line based

Linting
php -l src/path/to/file.php

Linting
find -L src tests -name '*.php' -print0
| xargs -0 -n 1 -P 4 php -l

Linting
• src/Location/City.php
• src/Name/FirstName.php
• src/Name/LastName.php

php-parallel-lint/php-parallel-lint

PHP Parallel Lint
• composer require --dev php-parallel-lint/php-parallel-lint
• ./vendor/bin/parallel-lint src tests

Linting
Production
Change
Dynamic
Automated
Tests
Static
Lint

Grep
• Debugging only functions
• var_dump()
• exit
• dd()

Grep
• In most Unix environments by default
• grep “thing we don’t want” src tests

Grep
Production
Change
Dynamic
Automated
Tests
Static
Lint
Grep

PHP_CodeSniffer
• phpcs -> validates code
• phpcbf -> fixes code (when possible)

PHP_CodeSniffer
1. Existing coding standards: PSR12, Pear, Zend, etc
2. Create from scratch
3. Existing + Extras

phpcs.xml v 1.0
<?xml version="1.0"?>
<ruleset name=“Super PSR12">
<description> PSR12 + Types</description>
<rule ref=“PSR12" />
</ruleset>

phpcs.xml v 1.0
./vendor/bin/phpcbf --standard=phpcs.xml src tests

–You (Maybe)
“How does this prevent bugs?”

Example
1.25 + 2.75
(int)1.25 + (int)2.75
1 + 2
3

RequireStrictTypes
Fatal error: Uncaught TypeError: add(): Argument #1 ($a) must be of type int,
float given, called in /home/user/scripts/code.php on line 9 and defined in
/home/user/scripts/code.php:5

phpcs.xml v 2.0
<ruleset name=“Super PSR+12">
<rule ref="Generic.PHP.RequireStrictTypes" />
</ruleset>

phpcs.xml v 2.0
1 | ERROR | Missing required strict_types declaration

Slevomat Coding Standard
• Slevomat Coding Standard library
• composer require --dev "slevomat/coding-standard"

phpcs.xml v 2.0
<ruleset name=“Super PSR+12">
<rule ref="Generic.PHP.RequireStrictTypes" />
<rule ref="SlevomatCodingStandard.TypeHints.PropertyTypeHint" />
<rule ref="SlevomatCodingStandard.TypeHints.ReturnTypeHint" />
<rule ref="SlevomatCodingStandard.TypeHints.ParameterTypeHint" />
</ruleset>

Pipeline Review
Production
Change
Dynamic
Automated
Tests
Static
Lint
grep
phpcs

Bug Finders
Fatal error: Uncaught Error: Cannot access private property User::$id

PHPStan
• Finds bugs in our code
• Check “correctness” of each line

PHPStan: Setup
• Install
• Composer require --dev phpstan/phpstan
• Running
• vendor/bin/phpstan analyse -l <number> src tests

PHPStan: Rule Levels
• Specify level of strictness using -l|--level parameter
• 0 -> Low Strictness
• 9 -> High Strictness

parameters:
ignoreErrors:
-
message: "#^Access to private property …::$id.$#”
count: 1
path: src/Location/User.php

PHPStan: Getting Started
1. Generate baseline at level 0
2. Fix all errors at current level
3. Increase level
4. Repeat until desired level

PHPStan
Production
Change
Dynamic
Automated
Tests
Static
Lint
phpcs
grep
PHPStan

PHP 7.4 To 8.0 Was
Challenging

Automating Refactoring
• Create a branch with PHP 8 installed
• Run through our tests
• Have someone manually fix the error

Rector
• Install
• composer require rector/rector --dev
• Create configuration
• ./vendor/bin/rector init

Rector: example
Fatal error: Uncaught Error: Call to undefined function create_function()

Rector: example
vendor/bin/rector —dry-run

Rector: example
vendor/bin/rector

Rector: example
• Run manually locally
• OR
• Add to GitHub Action

Production
Part 3: Code Readability/Maintainability
Change
Dynamic
Automated
Tests
Static
Lint
phpcs PHPStan
grep Rector

What You Need to Know
Static Code Analysis allows us to analyze our code without running it

Process
Input(s) Output(s)

IDE
Test Server
Pre-Commit

• PHP Parallel Lint
• Grep
• PHP_CodeSniffer
• PHPStan
• Rector

Questions?
• Scott Keck-Warren
• Url for resources

Static Code Analysis PHP[tek] 2023

More Related Content

Similar to Static Code Analysis PHP[tek] 2023 (20)

More from Scott Keck-Warren (10)

Recently uploaded (20)

Static Code Analysis PHP[tek] 2023

Editor's Notes