4 ms·

Catching bugs early with static analysis

57 points by andreascreten 7y ago

phpdave11 7y ago
PHPStan is a great tool. In addition to PHPStan, I also use phpnsc (name space checker) to check for missing use statements, php-cs-fixer (code style fixer) to ensure the code adheres to my code style, phpcpd (copy paste detector) to detect duplicate code, and phpmd (mess detector) to find potential problems in the code. These are all set up in my CI pipeline so that my app will fail to build if any of these 5 tools detect a problem. It has saved me from deploying buggy code several times.
- andreascreten 7y ago
  Makes sense, thanks for sharing!
- king7532 7y ago
  Great advice and thank you for sharing! Do you have a Dockerfile or CI config/recipe that you could share?
  - phpdave11 7y ago
    Here's the bash script I use to do the code validation. It's called from within my Dockerfile. https://gist.github.com/phpdave11/412893f8366cab0afa85e81a7a66bd72#file-validate-code-sh https://gist.github.com/phpdave11/412893f8366cab0afa85e81a7a...
- blowski 7y ago
  Here’s a GitHub repo and Docker image with lots more static analysis tools to play with: https://github.com/jakzal/phpqa https://github.com/jakzal/phpqa
baybal2 7y ago
Very helpful in the JS world, but I am afraid there is not standalone standard for static checks in JS. There is typescript, but that's an entire new language to just partially cover the type checks.
- bcherny 7y ago
  If you compile your code with TypeScript and set allowJs=true, you’ll get a lot of checking for free with no changes at all to your existing JS code. TS will catch things like dead code, missing return statements, type mismatches and so on for free.
  - baybal2 7y ago
    It will be nice if the use case of TS only being used as a static checker be supported better, but then there will be no point in TS as a language
    - oakesm9 7y ago
      If that's the use case you have, then Facebook's Flow is a better fit.
    - bcherny 7y ago
      What kind of additional support do you wish TS had, that it doesn’t have already?
- xenorplxx 7y ago
  alternative to typescript would be facebook's flow.js, which works with 'normal' JS code
- tru3_power 7y ago
  Fortify SCA supports js and typescript. I’ve been writing custom rules for it lately at work and have had great success with it. Expensive but powerful tool.

57 points by andreascreten 7y ago

PHPStan is a great tool. In addition to PHPStan, I also use phpnsc (name space checker) to check for missing use statements, php-cs-fixer (code style fixer) to ensure the code adheres to my code style, phpcpd (copy paste detector) to detect duplicate code, and phpmd (mess detector) to find potential problems in the code. These are all set up in my CI pipeline so that my app will fail to build if any of these 5 tools detect a problem. It has saved me from deploying buggy code several times.

andreascreten 7y ago
Makes sense, thanks for sharing!
king7532 7y ago
Great advice and thank you for sharing! Do you have a Dockerfile or CI config/recipe that you could share?
- phpdave11 7y ago
  Here's the bash script I use to do the code validation. It's called from within my Dockerfile. https://gist.github.com/phpdave11/412893f8366cab0afa85e81a7a66bd72#file-validate-code-sh https://gist.github.com/phpdave11/412893f8366cab0afa85e81a7a...
blowski 7y ago
Here’s a GitHub repo and Docker image with lots more static analysis tools to play with: https://github.com/jakzal/phpqa https://github.com/jakzal/phpqa

baybal2 7y ago

Very helpful in the JS world, but I am afraid there is not standalone standard for static checks in JS. There is typescript, but that's an entire new language to just partially cover the type checks.

bcherny 7y ago
If you compile your code with TypeScript and set allowJs=true, you’ll get a lot of checking for free with no changes at all to your existing JS code. TS will catch things like dead code, missing return statements, type mismatches and so on for free.
- baybal2 7y ago
  It will be nice if the use case of TS only being used as a static checker be supported better, but then there will be no point in TS as a language
  - oakesm9 7y ago
    If that's the use case you have, then Facebook's Flow is a better fit.
  - bcherny 7y ago
    What kind of additional support do you wish TS had, that it doesn’t have already?
xenorplxx 7y ago
alternative to typescript would be facebook's flow.js, which works with 'normal' JS code
tru3_power 7y ago
Fortify SCA supports js and typescript. I’ve been writing custom rules for it lately at work and have had great success with it. Expensive but powerful tool.