The static analyzer tool PHPStan has been added to Drupal Core

⚠️ The format of the baseline in Drupal core has changed, see Drupal core now stores its PHPStan baseline in PHP format

The static analyzer tool PHPStan has been added to Drupal Core. We are running the tool with level 0 (the lowest level). The power of static analyzer is that it can find bugs in your code without having to write tests. PHPStan has been added to the script core/scripts/dev/commit-code-check.sh which is part of the testbot.

The PHPStan configuration file is located at: core/phpstan.neon.dist

The PHPStan file with the skipped exceptions is located at: core/phpstan-baseline.neon

CLI Commands

Running PHPStan on drupal core: vendor/bin/phpstan analyze --configuration=core/phpstan.neon.dist

Regenerating the baseline: vendor/bin/phpstan analyze --configuration=core/phpstan.neon.dist --generate-baseline ./core/phpstan-baseline.neon

Running a full PHPStan analysis or regenerating the baseline, can take up to 10 minutes. You can also run PHPStan on a list of files only.
vendor/bin/phpstan analyze --configuration=core/phpstan.neon.dist file1.php file2.php
The DrupalCi testbot always does a full phpstan analysis on all of Drupal Core.