openapi-psr7-validator VS Infection

There is a package within The PHP League that allows validation of an OpenAPI specification: league/openapi-psr7-validator. This package validates requests and responses to the PSR-7 specification.

- https://github.com/thephpleague/openapi-psr7-validator for validation

how does this compare with https://github.com/thephpleague/openapi-psr7-validator

One tool destined for the PHP community and maintained by The PHP League is OpenAPI PSR-7 Message Validator, a package validating PSR-7 HTTP messages against OpenAPI definitions.

Request validation in a middleware layer using thephpleague/openapi-psr7-validator that allows us to validate 99% of an incoming request without the need for boilerplate checks in our handlers/controllers. Business specific checks will still need to be handled in the handler/controller though: eg, make sure user email is unique or validate account ID is still active, etc.

OpenAPI PSR-7 Message (HTTP Request/Response) Validator: It validates PSR-7 messages (HTTP request/response) against OpenAPI specifications.

And, imagine my surprise, even a Symfony-dedicated lib that does the same under the hood: https://github.com/thephpleague/openapi-psr7-validator

consider adding mutation tests

Obviously, we can not generate mutants manually. For that purpose, there are mutation testing utilities. For PHP, we have Infection.

Infection: PHP Mutation Testing library. Plugins: roave/infection-static-analysis-plugin: Static analysis on top of mutation testing - prevents escaped mutants from being invalid according to static analysis bitexpert/captainhook-infection: Captain Hook Plugin to run InfectionPHP only against the changed files of a commit

Infection: PHP Mutation Testing library. Plugins: roave/infection-static-analysis-plugin: Static analysis on top of mutation testing - prevents escaped mutants from being invalid according to static analysis bitexpert/captainhook-infection: Captain Hook Plugin to run InfectionPHP only against the changed files of a commit

If you want to enforce testing automatically probably the best option is to rely on mutation testing, using Infection. That doesn't just check that the tests cover the code, it checks that if the code was different to what it is then the tests would (usually) fail.

IMO code coverage is a very flawed metric on its own. A high percentage doesn't guarantee that the tests actually test the right things, and it would be much more efficient if mutation testing was used (e.g. Infection). It still uses the generated code coverage reports, but only as a base for its own metrics.

For your last edit - you can also add infection which will infect your code with other values, like if you expect a positive number, it will try and inject a negative number - and see what happens - does your code break everything or something. Also it will try to inject false where you might expect a true and many many other things, and yes you will get some weird results from infection, but its a good thing to look at, and atleast check the logs and see why the infection failed at a test.

The only one that I've used is infection for PHP.

That's practically a light form of mutant testing. Have you checked Infection?