CodeClimate VS PHPStan

- code climate It’s like Sonarqube but doesn’t offer detailed reports and doesn’t support all languages, you can see it from here https://codeclimate.com/

Resource Link: CodeClimate

Want to know how to enforce allowing only high-quality software into production? Check out this post on how to use CodeClimate can help you do just that! #DevOps #SoftwareDeveloper #softwaredevelopment #SoftwareEngineering #webdevelopment #codequality

Ideally, software can quickly go from development to production. Continuous deployment and delivery are some processes that make this possible. Continuous deployment means establishing an automated pipeline from development to production while continuous delivery means maintaining the main branch in a deployable state so that a deployment can be requested at any time. Predecos uses these tools. When a commit goes into master, the code is pushed directly to the public environment. Deployment also occurs when a push is made to a development branch enabling local/e2e testing before push to master. In this manner the master branch can be kept clean and ready for deployment most of the time. Problems that surface resulting from changes are visible before reaching master. Additional automated tools are used. Docker images are built for each microservice on commit to a development or master branch, a static code analysis is performed by SonarCloud revealing quality and security problems, Snyk provides vulnerability analysis and CodeClimate provides feedback on code quality while Coveralls provides test coverage. Finally, a CircleCI build is done. Each of these components use badges which give a heads-up display of the health of the system being developed. Incorporating each of these tools into the development process will keep the code on a trajectory of stability. For example, eliminating code smells, security vulnerabilities, and broken tests before merging a pull-request (PR) into master. Using Husky on development machines to ensure that code is well linted and locally tested before it is allowed to be pushed to source-control management (SCM). Applying additional processes such as writing tests around bugs meaning reintroduction of a given bug would cause a test to fail. The automated tools would then require that test to be fixed before push to SCM meaning fewer bugs will be reintroduced. Proper development processes and automation have a strong synergy.

The new code should not drop existing code coverage I've found in practice mainly catches changes to existing code that lack proper updates to existing tests. Our company uses Code Climate for these checks, so we don't have to manage / write our own tooling for this purpose.

Code Climate

Some exciting NYC companies tech companies I like are alloy.co, hyperscience.com, vanta.com, and codeclimate.com.

Best code quality - Thanks to SaaS such as CodeClimate I can tell when my code quality is too low. I try to keep "code smells" absolute zero.

PHPStan: composer require --dev phpstan/phpstan

To do so simply install the runtime/frankenphp-symfony composer package. Then we install the bare minimum for a kick ass developer experience, a linter using Code Sniffer, phpstan as code quality audit tool, Rector to ease and automate code maintenance, some useful Symfony components and package and of course the Doctrine ORM. Here the composer.json file located at the symfony folder root.

At DinnerBooking, we've tackled this challenge using PHPStan. Here’s how:

As part of the journey to PHP perfection, you should embrace Rector. It's a amazing, free, and open-source tool for migrations, code quality, type coverage, pushing PHPStan to the highest levels, and yes, it can even auto-fix your existing code! It seamlessly integrates into the CI process, making your development workflow smoother than ever.

PHPStan focuses on finding errors in PHP code without running it. It captures all types of errors, even before you write tests. It brings PHP closer to compiled languages by checking the correctness of each line of code before execution.

PHPStan is a static analysis tool for PHP. Larastan is a package built on top of PHPStan to make it easier to integrate with Laravel projects. PHPStan works by "sniffing" the code using the various rulesets applied to it and determine if it follows the standards. However, Larastan doesn't fully follow the definition of "static analysis" since it has to boot the application's container and resolve the types that can only be computed at runtime. This is why Larastan is called a "code analysis" tool rather than a "static analysis" tool.

PHPStan: PHP Static Analysis Tool - discover bugs in your code without running it! Plugins: ergebnis/phpstan-rules: Provides additional rules for phpstan/phpstan. spaze/phpstan-disallowed-calls: PHPStan rules to detect disallowed calls and constant & namespace usages roave/no-floaters: static analysis rules to prevent IEEE-754 floating point errors. dave-liddament/php-language-extensions: Attributes to define PHP language extensions (to be enforced by static analysis) sidz/phpstan-rules: Additional rules for phpstan/phpstan. staabm/phpstan-baseline-analysis: Analyzes PHPStan baseline files and creates aggregated error trend-reports More extensions

So, in this article we have written a fairly simple but functional rule for PHPStan. We have discussed the basics of PHPStan and now we can cover our project with more complex tests. I also recommend reading the developer documentation. It won't take you long to learn more rule development features.

You could try something like PHP Stan. It scans your code for defects and lists them all for you. It probably won't catch everything, but it'll certainly help, and it's free