PHPStan job fails permanently on 3.x, so it gives no signal on new errors

Problem

The phpstan CI job fails on every 3.x pipeline. Because it is configured allow_failure: true, the pipeline still reports success, so the failure is easy to miss — but the practical effect is that static analysis provides no signal: a newly introduced error is indistinguishable from the existing ones, since the job is red either way.

Example: pipeline 896107 on 3.x (commit 3faa145d) reports phpstan: failed while the pipeline overall is green. The same is true of the preceding weekly runs.

The two errors

modules/custom_elements_ui/custom_elements_ui.module, line 59:

• custom_elements_ui_entity_operation() implements hook_entity_operation but is missing the CacheableMetadata parameter added in Drupal 11.3. Rule drupal.proceduralHookEntityOperationMissingCacheabilityParameter, see change record 3533080.

tests/src/Functional/CustomElementsRenderMarkupTest.php, line 79:

• Storing entity storage as a class property is not recommended; call EntityTypeManagerInterface::getStorage() at the call site instead. Rule drupal.entityStoragePropertyAssignment.

There is no phpstan-baseline.neon committed in the repository, so the findings have nowhere to be suppressed and the job cannot go green as things stand.

Options

• Fix both. Only two findings, and the first is a genuine Drupal 11.3 forward-compatibility fix worth making on its own merits. Note the hook signature change needs a look at the supported core range before landing.
• Commit a baseline. Generate phpstan-baseline.neon from the current state so the job goes green and only new errors fail it. This is what most contrib modules do, and the CI template already produces the baseline as a downloadable artifact on each run.

Either restores the property that matters: a red phpstan job should mean something changed.

How this surfaced

Noticed while working on #3612219. That MR's pipeline reported phpstan errors, and separating "introduced by this MR" from "already failing on 3.x" required manually pulling a 3.x pipeline and diffing the error lists — which is the cost this issue describes.

Drafted with the assistance of AI (Claude Code / Opus 4.8).