PHPStan

CodeRabbit runs PHPStan to find type errors and other issues in PHP code.

PHPStan is a static analysis tool for PHP. CodeRabbit includes PHPStan in its sandbox and uses the Composer-installed vendor/bin/phpstan instead when available.

CodeRabbit runs PHPStan v2.2.16.

Files

PHPStan will run on files with the following extensions:

• .php

Configuration

enabled · boolean · default: true

Enable PHPStan: PHPStan requires config file in your repository root. Please ensure that this file contains the paths: parameter.

level · enum · default: "default"

Level: Specify the rule level to run. When set to default, the level is determined by the review profile: chill uses level 3 (real bugs only — return/property type mismatches, array offset errors) and assertive uses level 8 (adds dead code detection, argument type checking, null safety, and typehint checks). This setting is ignored if your configuration file already has a level: parameter.

One of: 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, default, max

.coderabbit.yaml

.coderabbit.yaml

reviews:
  tools:
    phpstan:
      enabled: true
      level: "default"

Web UI

In your organization or repository settings, go to Reviews → Tools and turn the tool on or off with its toggle. To change its other settings, click the settings icon next to the toggle.

CodeRabbit looks for the following PHPStan config files in the repository root:

• phpstan.neon
• phpstan.neon.dist
• phpstan.dist.neon

If no PHPStan config file is found, CodeRabbit writes a temporary config based on the selected review profile.

What CodeRabbit runs

PHPStan runs in a sandbox with the project config if present. If a project config is present, we parse and validate the config before execution.

Analysis scope

With a generated config, CodeRabbit passes the changed PHP files to PHPStan as the analysis scope. With a repository-provided config, CodeRabbit narrows analysis to changed files when a root composer.json is present and dependency installation succeeds. Without composer.json, CodeRabbit keeps the analysis paths declared by the repository config to avoid false unresolved-symbol findings. If Composer installation fails, PHPStan does not run.

For large changed-file sets, CodeRabbit analyzes the files in bounded parts and combines the findings.

Composer dependencies

When the repository root contains composer.json, CodeRabbit installs Composer dependencies in the review sandbox, including when CodeRabbit generates the PHPStan config. Composer uses a writable cache inside the sandbox, and each installation attempt has a 120-second timeout. After analysis, CodeRabbit removes the PHPStan and Composer cache directories.

When Composer setup fails

If Composer dependency installation fails, the review explains the failure. The message distinguishes private-package access, dependency resolution, outdated lock files, unreachable registries, unavailable packages, sandbox cache failures, timeouts, and unclassified failures. It does not expose raw package names or host names.

When private dependencies are not accessible, disable the built-in PHPStan check and rely on PHPStan output from your own CI pipeline instead.

Profile behavior

• With level: default and a generated config, Chill uses level 3 and reports findings as errors.
• With level: default and a generated config, Assertive uses level 8 and reports findings as warnings.

When CodeRabbit generates the PHPStan config, both profiles ignore these identifiers:

• constructor.unusedParameter
• closure.unusedUse
• class.nameCase
• method.nameCase
• phpDoc.parseError
• phpDoc.phpstanTag
• return.phpDocType
• missingType.generics
• missingType.iterableValue
• phpDoc.variance
• generics.variance
• class.notFound
• method.notFound
• function.notFound
• attribute.notFound
• property.notFound
• variable.undefined

The generated Assertive config additionally ignores:

• method.unused
• classConstant.unused
• property.unused
• return.unusedType
• property.unusedType
• trait.unused
• missingType.return
• missingType.parameter
• missingType.property
• missingType.callable

CodeRabbit always filters property.notFound and variable.undefined from review comments, including when the repository supplies its own config.

Security policy and restrictions

• We reject any supported PHPStan config that declares bootstrapFile or bootstrapFiles to prevent executing arbitrary project bootstrap code.
• Blocked configuration keys include:
  • bootstrapFiles
  • bootstrapFile
• If a config declares includes:, CodeRabbit does not resolve the included files. It discards the repository config and uses a generated profile config for the run.
• Composer dependency installation disables plugins and scripts.

When we skip PHPStan

CodeRabbit will skip running PHPStan when:

• PHPStan is disabled in your CodeRabbit configuration.
• No supported changed PHP files remain in the sandbox worktree.
• The config file does not contain a paths: parameter.
• The config contains bootstrapFile or bootstrapFiles.
• PHPStan is already running in GitHub Actions, GitLab CI, CircleCI, or Azure Pipelines.
• Config parsing fails or appears unsafe.

Use this skip list together with Composer failure reporting and the analysis scope to understand whether PHPStan runs and which files it analyzes.

Links

• PHPStan Configuration