Practical Advanced Static Analysis

on YouTube ↗50m

" summary

Advanced static analysis actually finds real bugs and evolvability defects: tools like PHPStan and Psalm (about 230-240 rules each) run over code, use plugins for frameworks, and can generate a baseline file so a legacy repo reports only new issues. Examples: custom rules block test-only setId calls, enums/match get backported via value objects plus Psalm type assertions, CI runs shrink a codebase from ~4,000 to ~1,000 reported issues over two years and materially speeds safe refactoring.

AI-written summary · about

" chapters (21)

1. 0:00Intro
2. 1:08The 4 stages of a team
3. 2:09What is static analysis
4. 3:09Static analysis examples
5. 5:18Static analysis vs tests
6. 6:20How do these tools work
7. 8:50Running the tools
8. 10:01Bugs
9. 12:36Evolvability
10. 15:25Type declarations
11. 17:26Array keys
12. 19:14Templates
13. 21:18Summary
14. 23:53Baseline
15. 25:54Workflow
16. 27:23Refactoring
17. 29:01Static Analysis
18. 34:23Refactor Code
19. 38:08Custom Rules
20. 41:48Conclusion
21. 44:08Questions

" related talks

• 55mSquash Bugs with Static AnalysisDave Liddament · International PHP Conference Munich 2018
• 25mTypes & static analysis are good in PHPSam Greenwood · Laracon AU 2019
• 53mStatic Analysis Saved My Code TonightDamien Damien Seguy · PHP UK Conference 2017
• 47mStatic Code Analysis: Judging a Forest by Its TreesChristian Rades · PHP UK Conference 2020
• 39mPractical Static Analysis for Continuous Application SecurityJustin Collins · AppSecUSA 2016
• 32mFrom Zero to Static Analysis HeroRyan Chandler · Laracon EU 2025
• 58mSecurity Static Analysis - Avoiding an Angry Mob of EngineersJosh Brown-White · NDC Oslo 2019
• 44mStatic analysis as an additional barrier against bugsSergey Khrenov · TestCon Moscow 2019