Code quality is not just for christmas, it is a daily part of the job. So, what do you do when you're handed with a five feet long pole a million lines of code that must be vetted ? You call static analysis to the rescue. During one hour, we'll be reviewing totally unknown code code : no name, no usage, not a clue. We'll apply a wide range of tools, reaching for anything that helps us understand the code and form an opinion on it. Can we break this mystery and learn how everyone else is looking at our code ?
3. Review some PHP code
We don't know what it does
We have never heard about it
We don't run it
We don't know the authors
Can we have an opinion?
4. Review the code
Reading code is humanly possible : its an art
Unit test are not adapted for review
Dynamic analysis is not fit for review
We need to explore code
We can only rely on the current state
33. Various AST
PHP7mar : nikic/php5-ast
PHAN : ext/ast (PHP 7 only)
PHPStan : based on reflection
Exakat : AST in a graph database
SonarQube : Java-build AST
PHPstorm : internal IDE AST
34. PHAN
PhanUndeclaredMethod Call to undeclared method
SyliusBundleChannelBundleTestsDependencyInjectionCompilerCompositeReques
tResolverPassTest::assertContainerBuilderHasServiceDefinitionWithMethodCall
(Did you mean expr-
>assertContainerBuilderNotHasServiceDefinitionWithMethodCall())
Total : 30566 results / 65 types
9459 issues
PhanParamTooMany Call with 4 arg(s) to
SyliusBundleMoneyBundleFormDataTransformerSyliusMoneyTransformer::__const
ruct() which only takes 0 arg(s) defined at projects/sylius/code/src/Sylius/
Bundle/MoneyBundle/Form/DataTransformer/SyliusMoneyTransformer.php:18
24 issues
PhanUnreferencedUseNormal Possibly zero references to use statement for
classlike/namespace OrderInterface
(SyliusComponentCoreModelOrderInterface)
171 issues
PhanParamTooFew : 36 issues
35. PHP 7 helps static analysis
Type hint, return type hint, scalar typehint
Usage of PHPDOC
Consistent behavior of PHP operators
Dynamic code is very difficult to analyze
36. PHP LINT
php -l <fichier.php>
Paralell executions
jakub-onderka/php-paralell-lint
Various versions of PHP : 7.0, 7.1, 7.2, 7.3, 5.6, 5.5
39. What does this app do?
Inventories of the application
Names for classes, methods, traits, variables,
interfaces…
List of literal in the code
Integers, real, arrays, strings
43. List of PHP analyzers
Exakat
PHPStan
Phan
Phploc
PHPmetrics
https://github.com/exakat/
php-static-analysis-tools
44. Large application
Symfony framework
No databases
Very low level of issues
Tend to use very modern PHP features
Backward compatibilities
Deal with sales : customers, sales