VOOZH about

URL: https://deepwiki.com/MahoCommerce/maho/11.3-static-analysis-and-code-quality

⇱ Static Analysis and Code Quality | MahoCommerce/maho | DeepWiki

Loading...
Loading...
Last indexed: 15 May 2026 (ea8ab8)
Menu

Static Analysis and Code Quality

This page documents the static analysis tools, code quality enforcement mechanisms, and automated validation workflows used in the Maho codebase. These systems ensure code correctness, consistency, and adherence to modern PHP standards through automated checks and baselines.

For information about the testing framework (Pest), see 11.4 Testing with Pest For information about the CI/CD pipeline architecture, see 11.2 CI/CD Pipeline

Toolchain Overview

Maho employs a multi-layered approach to code quality, combining static analysis, modernization rules, and style fixers. The project targets PHP 8.3+ compatibility .github/workflows/syntax-php.yml19 and enforces strict syntax checks for both PHP and XML files.

Quality Assurance Integration Flow

The following diagram illustrates how different tools interact with the codebase to enforce quality gates during development and in the GitHub Actions CI environment.

Code Quality Pipeline Architecture



Sources: .github/workflows/syntax-php.yml12-20 .github/workflows/syntax-xml.yml12-14 .php-cs-fixer.php7-11 .github/workflows/rector.yml39-41




PHPStan Static Analysis


PHPStan is the primary tool for detecting bugs and type inconsistencies. It ensures that modern type hints and strict PHP 8.3+ logic are respected across the platform.


CI Integration


PHPStan runs in the CI pipeline across multiple PHP versions (8.3, 8.4, 8.5) to ensure cross-version compatibility .github/workflows/phpstan.yml19 It utilizes a result cache stored in the var directory to speed up subsequent runs .github/workflows/phpstan.yml43-52 The analysis is executed via vendor/bin/phpstan.phar analyze with high verbosity and Xdebug disabled for performance .github/workflows/phpstan.yml54


Configuration and Baselines


The project utilizes configuration files (e.g., .phpstan.dist.neon) and baselines to manage legacy technical debt while enforcing high standards on new code. These files are excluded from standard exports to keep the production package lean .gitattributes7-8


Sources: .github/workflows/phpstan.yml1-62 .gitattributes7-8 .gitignore36-40




Rector Modernization


Rector is used to automatically upgrade the codebase to support modern PHP features and maintain consistency with Maho's modernization goals.


Automation and Rules


Maho uses Rector to handle large-scale refactorings that would be error-prone if done manually. The configuration in .rector.php (referenced in .github/workflows/rector.yml40) handles tasks such as:


    

  • PHP 8.3+ Features: Upgrading syntax to leverage the latest engine improvements.
    • 

  • Dry Run Validation: The CI pipeline executes Rector using php vendor/bin/rector -c .rector.php --dry-run to ensure no regressions are introduced .github/workflows/rector.yml40
    • 

  • Dependency Management: Rector is installed via Composer and cached in CI to optimize execution time .github/workflows/rector.yml30-37
    • 



Sources: .github/workflows/rector.yml1-41 .gitattributes9




PHP-CS-Fixer and Syntax Enforcement


Maho enforces a strict coding style and performs automated syntax validation for both PHP and XML files.


PHP-CS-Fixer Rule Configuration


The coding style is enforced via friendsofphp/php-cs-fixer. The configuration in .php-cs-fixer.php adopts the @PER-CS2.0 rule set .php-cs-fixer.php13 It also enforces:



Syntax Linting


Automated workflows perform "lint" checks on every pull request to catch trivial errors:



Sources: .github/workflows/syntax-php.yml1-65 .github/workflows/syntax-xml.yml1-60 .php-cs-fixer.php1-42




Specialized Quality Checks


Beyond general static analysis, Maho implements domain-specific validation workflows.


Copyright and Licensing


Maho enforces a specific copyright header for all modified files. The Copyright Check workflow validates that every changed .js, .php, or .phtml file contains the Maho copyright notice .github/workflows/copyright.yml76-86



Translation Integrity


Two dedicated workflows ensure translation health:


    

  1. Missing Translations: Uses ./maho dev:translations:missing to detect translatable strings in changed files that lack CSV entries .github/workflows/check-missing-translations.yml37
    2. 

  2. Unused Translations: Uses ./maho dev:translations:unused to find obsolete entries in translation files .github/workflows/check-unused-translations.yml35
    3. 



Sources: .github/workflows/copyright.yml1-100 .github/workflows/check-missing-translations.yml1-46 .github/workflows/check-unused-translations.yml1-43




Code Quality Case Study: Database Layer Modernization


The transition to Doctrine DBAL and the Maho\Db\Select wrapper demonstrates how code quality tools manage complex architectural shifts.


Database Layer Quality Architecture




Implementation Details


    

  • Multi-Engine Testing: Quality is verified by running the test suite against mysql-8.4, mariadb-10.11, pgsql-14, and sqlite .github/workflows/pest.yml19-56
    • 

  • Strict Typing: New components like Maho\Db\Select are analyzed by PHPStan to ensure they correctly interface with Doctrine DBAL 4.4 types.
    • 

  • CI Validation: Every commit is verified for database installation and reindexing integrity across all supported engines .github/workflows/pest.yml101-125
    • 



Sources: .github/workflows/pest.yml13-56 .github/workflows/pest.yml101-125 .php-cs-fixer.php13-17