Download the PHP package symplify/phpstan-rules without Composer

PHPStan Rules

Set of 35 custom PHPStan rules that check architecture, typos, class namespace locations, accidental visibility override and more. Useful for any type of PHP project, from legacy to modern stack.

Install

Note: Make sure you use phpstan/extension-installer to load necessary service configs.

Usage

Later, once you have most rules applied, it's best practice to include whole sets:

But at start, make baby steps with one rule at a time:

Jump to: PHPUnit-specific rules.

Special rules

Tired of ever growing ignored error count in your phpstan.neon? Set hard limit to keep them low:

CheckRequiredInterfaceInContractNamespaceRule

Interface must be located in "Contract" or "Contracts" namespace

:x:

:+1:

ClassNameRespectsParentSuffixRule

Class should have suffix "%s" to respect parent type

:wrench: configure it!

↓

:x:

:+1:

StringFileAbsolutePathExistsRule

Absolute file path must exist. Checked suffixes are "yaml", "yml", "sql", "php" and "json".

:x:

:+1:

NoConstructorOverrideRule

Possible __construct() override, this can cause missing dependencies or setup

:x:

:+1:

ExplicitClassPrefixSuffixRule

Interface have suffix of "Interface", trait have "Trait" suffix exclusively

:x:

:+1:

ForbiddenArrayMethodCallRule

Array method calls [$this, "method"] are not allowed. Use explicit method instead to help PhpStorm, PHPStan and Rector understand your code

:x:

:+1:

NoJustPropertyAssignRule

Instead of assigning service property to a variable, use the property directly

:x:

:+1:

ForbiddenExtendOfNonAbstractClassRule

Only abstract classes can be extended

:x:

:+1:

ForbiddenNewArgumentRule

Type "%s" is forbidden to be created manually with new X(). Use service and constructor injection instead

↓

:x:

:+1:

ForbiddenFuncCallRule

Function "%s()" cannot be used/left in the code

:wrench: configure it!

↓

:x:

:+1:

ForbiddenMultipleClassLikeInOneFileRule

Multiple class/interface/trait is not allowed in single file

:x:

:+1:

ForbiddenNodeRule

"%s" is forbidden to use

:wrench: configure it!

↓

:x:

:+1:

ForbiddenStaticClassConstFetchRule

Avoid static access of constants, as they can change value. Use interface and contract method instead

:x:

:+1:

NoDynamicNameRule

Use explicit names over dynamic ones

:x:

:+1:

NoEntityOutsideEntityNamespaceRule

Class with #[Entity] attribute must be located in "Entity" namespace to be loaded by Doctrine

:x:

:+1:

NoGlobalConstRule

Global constants are forbidden. Use enum-like class list instead

:x:

:+1:

NoReferenceRule

Use explicit return value over magic &reference

:x:

:+1:

NoReturnSetterMethodRule

Setter method cannot return anything, only set value

:x:

:+1:

NoTestMocksRule

Mocking "%s" class is forbidden. Use direct/anonymous class instead for better static analysis

:x:

:+1:

PreferredClassRule

Instead of "%s" class/interface use "%s"

:wrench: configure it!

↓

:x:

:+1:

PreventParentMethodVisibilityOverrideRule

Change "%s()" method visibility to "%s" to respect parent method visibility.

:x:

:+1:

RequiredOnlyInAbstractRule

@required annotation should be used only in abstract classes, to child classes can use clean __construct() service injection.

RequireRouteNameToGenerateControllerRouteRule

To pass a controller class to generate() method, the controller must have "#[Route(name: self::class)]" above the __invoke() method

SingleRequiredMethodRule

There must be maximum 1 @required method in the class. Merge it to one to avoid possible injection collision or duplicated injects.

RequireAttributeNameRule

Attribute must have all names explicitly defined

:x:

:+1:

NoRouteTrailingSlashPathRule

Avoid trailing slash in route path, to prevent redirects and SEO issues

RequireAttributeNamespaceRule

Attribute must be located in "Attribute" namespace

:x:

:+1:

RequireExceptionNamespaceRule

Exception must be located in "Exception" namespace

:x:

:+1:

RequireUniqueEnumConstantRule

Enum constants "%s" are duplicated. Make them unique instead

:x:

:+1:

SeeAnnotationToTestRule

Class "%s" is missing @see annotation with test case class reference

:wrench: configure it!

↓

:x:

:+1:

UppercaseConstantRule

Constant "%s" must be uppercase

:x:

:+1:

2. Doctrine-specific Rules

RequireQueryBuilderOnRepositoryRule

Prevents using $entityManager->createQueryBuilder('...'), use $repository->createQueryBuilder() as safer.

NoGetRepositoryOutsideServiceRule

Instead of getting repository from EntityManager, use constructor injection and service pattern to keep code clean

:x:

:+1:

NoParentRepositoryRule

Repository should not extend parent repository, as it can lead to tight coupling

:x:

:+1:

NoRepositoryCallInDataFixtureRule

Repository should not be called in data fixtures, as it can lead to tight coupling

:x:

:+1:

3. Symfony-specific Rules

FormTypeClassNameRule

Classes that extend AbstractType should have *FormType suffix, to make it clear it's a form class.

NoConstructorAndRequiredTogetherRule

Constructor injection and #[Required] method should not be used together in single class. Pick one, to keep architecture clean.

NoGetDoctrineInControllerRule

Prevents using $this->getDoctrine() in controllers, to promote dependency injection.

NoGetInControllerRule

Prevents using $this->get(...) in controllers, to promote dependency injection.

NoAbstractControllerConstructorRule

Abstract controller should not have constructor, as it can lead to tight coupling. Use @required annotation instead

:x:

:+1:

NoRoutingPrefixRule

Avoid global route prefixing. Use single place for paths in @Route/#[Route] and improve static analysis instead.

:x:

:+1:

NoClassLevelRouteRule

Avoid class-level route prefixing. Use method route to keep single source of truth and focus

:x:

:+1:

NoFindTaggedServiceIdsCallRule

Instead of "$this->findTaggedServiceIds()" use more reliable registerForAutoconfiguration() and tagged iterator attribute. Those work outside any configuration and avoid missed tag errors

NoRequiredOutsideClassRule

Symfony #[Require]/@required should be used only in classes to avoid misuse

:x:

:+1:

SingleArgEventDispatchRule

The event dispatch() method can have only 1 arg - the event object

:x:

:+1:

NoListenerWithoutContractRule

There should be no listeners modified in config. Use EventSubscriberInterface contract and PHP instead

:x:

:+1:

NoStringInGetSubscribedEventsRule

Symfony getSubscribedEvents() method must contain only event class references, no strings

:x:

:+1:

RequireInvokableControllerRule

Use invokable controller with __invoke() method instead of named action method

:x:

:+1:

4. PHPUnit-specific Rules

NoMockObjectAndRealObjectPropertyRule

Avoid using one property for both real object and mock object. Use separate properties or single type instead

NoEntityMockingRule, NoDocumentMockingRule

Instead of entity or document mocking, create object directly to get better type support

:x:

:+1:

NoAssertFuncCallInTestsRule

Avoid using assert*() functions in tests, as they can lead to false positives

NoMockOnlyTestRule

Test should have at least one non-mocked property, to test something

:x:

:+1:

PublicStaticDataProviderRule

PHPUnit data provider method "%s" must be public

:x:

:+1:

Happy coding!