Next Chapter in PHPStan Saga

Ondřej Mirtes
5 min readDec 6, 2018

On December 4th 2016, I released a first version of PHPStan to the public. Two years, 2,5 million downloads and 5,400 GitHub stars later, it’s going strong and I have many ideas how to improve it. My to-do list is almost infinite.

Also, I’m turning 30 tomorrow. My 20s were characterized by learning and becoming competent at what I do for my employers. I’d like my 30s to be about taking destiny into my own hands and finding path to work independence, working on what I want and on my own schedule.

I ❤️ Open-Source

I believe that open-source is the right model for developing software. We interact with it every day without even realizing it. We all take Linux, Git, gcc, WebKit, PHP, Composer, PCRE, and many others for granted. curl is installed on billions of devices. Well, even sudo is an active standalone open-source project with 30+ years of history.

PHPStan wouldn’t be so popular and so good today if it wasn’t open-source. Everyone can try it out by installing it through Composer and also contribute to it by sending a pull request on GitHub. More than 120 people helped improve PHPStan. I’d very much like this trend to continue so don’t worry, PHPStan will stay open-source and I will continue to work on it in this form.

Of course, the elephant in the room is monetization. Right now, I’m accepting money through Patreon, release sponsorships and one-time donations on PayPal. It brings in only one or two months worth of salary per year, which is nice, but not nearly enough to go full-time and support my family.

Enter PHPStan Pro

Which is why I came up with the idea of PHPStan in the form of SaaS and I think it’s a great fit. It’s going to be based on the open-source version so I will still have incentives to make it as awesome as possible.

PHPStan Pro will offer these features:

Instant feedback. Currently, you always have to run PHPStan on the whole project which can take minutes in case of really large ones. It’s trivial to get a list of changed files in a branch from Git, but not sufficient. By changing file A, you can break something in file B. PHPStan builds a dependency tree between files so by changing 8 files, it knows it has to run analysis on these 50 files instead of the whole project. So you get feedback in seconds instead of minutes, but don’t miss out on any errors.

Support for legacy projects. PHPStan has so-called rule levels which are great but can get you only so far. Some projects can get 5000 errors on level 0 and are stuck. And even if your project is in a better shape and you’re on one of the lower levels like 2 or 3, you’re missing out on real bugs from higher levels.

I also noticed something I call “main branch phenomena”. The code that has been in production for weeks, months and years is most likely fine and clear of any obvious errors. What PHPStan finds in it are most likely minor issues like wrong phpDocs and less severe problems. What developers want is to focus on new and changed code and hold it to a higher standard.

This will be solved by a feature called “the baseline”. It acknowledges that a project has a set of errors that are there when PHPStan is first enabled, but won’t allow these errors in new or changed code. It tracks specific errors on specific lines throughout history, so it’s able to tell “you fixed these 5 errors, but these other 3 new errors appeared”.

Analysis output after baseline filtering.

Always the latest version. Because PHPStan is getting smarter and finds new issues in code all the time, immediate upgrade to a new version is not always possible. Because you want to keep the build green, you have to solve new errors first, or lower your level. You will be able to add the newly found errors to the baseline, upgrade and take advantage of the latest features immediately.

Running in the cloud. Today, you have to run PHPStan on your CI server, or on your local machine. By taking advantage of the cloud and parallelization, you will be able to get even faster feedback and also save your own hardware resources. PHPStan will run at the same time as the rest of your CI build, saving you time.

Reporting errors directly on GitLab/GitHub. Instead of scrolling through a long text log of your CI build, you will be able to read the errors right next to the code.

Automatic pull requests with fixes. PHPStan will become a full-fledged member of your team! Not only it finds errors in your code, it will also send you occasional pull requests with dead code removal, added missing typehints etc.

All of these features are designed with composability in mind so you don’t have to use them all at once. For example running PHPStan in the cloud means that you will have to give the SaaS access to your source code. Not everyone is okay with that, but they can still take advantage of the rest of the features. Someone else might not need the baseline, but wants faster analysis.

As of today, these features are ready for betatesting:

  • Instant feedback — running analysis on changed files and their dependencies
  • Support for legacy projects — filtering reported errors with the baseline
  • Always the latest version

They require you to run PHPStan in your CI with the help of an API client providing the smart algorithms. I want to work out the kinks with a few selected partners and individual approach. That’s why I prepared a form — you can show interest in this service by filling it out.

👉 Fill out the form — show interest in PHPStan Pro betatest 👈

Right now, I’m not able to determine how much the service will cost — that’s what I also want to figure out with the betatest partners, but I guess it will be in the realm of tens of euros per month per repository. At some point in 2019, I will launch PHPStan Pro with general availability — you’ll be able to punch in your credit card number and get going.

If you’re a PHP developer, give PHPStan a shot. If you’re interested in various insights about software development, follow me on Twitter.

--

--

Ondřej Mirtes

Author of PHPStan, static analysis tool for finding bugs in code without running it.