PHP can accept code that is syntactically valid but still contains impossible method calls, incorrect return values, invalid argument types, or null-handling mistakes. PHPStan finds many of these defects without executing the application.

phpstan:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v7
    - uses: shivammathur/setup-php@v2
      with:
        php-version: "8.3"
        tools: composer:v2
        coverage: none
    - run: composer install --no-interaction --prefer-dist --no-progress
    - name: Report PHPStan findings
      continue-on-error: true
      run: vendor/bin/phpstan analyse --configuration=phpstan.neon --no-progress

Composer dependencies are required because PHPStan must resolve the application’s classes and interfaces. phpstan.neon defines analyzed paths, rule level, Drupal extensions, exclusions, and any temporary baseline.

Incremental adoption

Start with a manageable rule level and analyze custom code. Fix real problems and use ignores only for demonstrated false positives. A baseline can record existing findings while preventing new code from increasing the count, but it should be debt to reduce rather than a permanent exemption.

Common Drupal findings include calling methods on possibly null entities, assuming fields are populated, returning the wrong response type, and missing service or plugin return types. PHPStan complements runtime tests; it does not replace them.