![Reducing Bugs With Static Code
Analysis
Scott Keck-Warren
php[tek] 2023
@scottKeckWarren@phpc.social
@scottKeckWarren@twitter.com](https://image.slidesharecdn.com/staticcodeanalysisphptek2023-230517122556-f35bc9a2/85/Static-Code-Analysis-PHP-tek-2023-1-320.jpg)
Recommended
Recommended
More Related Content
Similar to Static Code Analysis PHP[tek] 2023
Similar to Static Code Analysis PHP[tek] 2023 (20)
More from Scott Keck-Warren
More from Scott Keck-Warren (6)
Recently uploaded
Recently uploaded (20)
Static Code Analysis PHP[tek] 2023
- 1. Reducing Bugs With Static Code Analysis Scott Keck-Warren php[tek] 2023 @scottKeckWarren@phpc.social @scottKeckWarren@twitter.com
- 4. How We Fixed Bugs (Don’t Do This) 1. Duplicate the bug 2. Fix it 3. Open SFTP connection to production 4. Manually edit the file 5. Cross our fingers nothing broke
- 7. What Happened? Parse error: syntax error, unexpected identifier "privte", expecting "function" or "const"
- 8. What Happened? Fatal error: Uncaught Error: Call to undefined method User::getId()
- 9. What Happened? • Type errors • Left over `echo` debug statements • `exit` in unexpected spot
- 10. What’s the Fix?
- 15. Reducing Bugs With Static Code Analysis Scott Keck-Warren php[tek] 2023 @scottKeckWarren@phpc.social @scottKeckWarren@twitter.com
- 16. Scott Keck-Warren Director of Technology @ WeCare Connect
- 18. Scott Keck-Warren Director of Technology @ WeCare Connect
- 19. Scott Keck-Warren Host @ PHP[Architect] YouTube Channel
- 22. Agenda 1. What is Static Code Analysis? 2. Where Do We Perform Static Code Analysis? 3. Tools For Static Code Analysis
- 23. What is Static Code Analysis?
- 24. What is Static Code Analysis? Two Ways to Analyze Code 1. Dynamic Code Analysis 2. Static Code Analysis
- 25. What is Static Code Analysis? Dynamic Code Analysis • Run code (manually or automatically) • Manual: slow and expensive • Automated: slow to create but infinitely repeatable
- 26. What is Static Code Analysis? Static Code Analysis • Analyze our source code without actually executing • Slow onboarding (maybe) on brownfield applications • Infinitely repeatable • Can be faster than dynamic tests
- 27. What is Static Code Analysis? What specifically can we do with Static Code Analysis? • Find errors • Adhere to standards • Automatically refactor our code
- 28. What is Static Code Analysis? • Teams size is not a limiting factor to using SCA • Compute can be
- 29. Where Do We Perform Static Code Analysis?
- 30. Feedback Loops
- 36. Feedback Loops:Worst Case • Change is made • Change is pushed to production • Problem found a month later • Problem is completely divorced from original change • Leaders to Confusion • What caused this? Process Input(s) Output(s )
- 37. Feedback Loops:Okay Case • Change is made on own branch • Change is heavily tested on testing server • Problem found during testing • Problem solved quick because change is still fresh in our mind Process Input(s) Output(s )
- 38. Feedback Loops:Better Case • Change is made on own branch • Change is heavily tested locally • Problem found before code leaves our computer • Problem solved quicker but still delayed Process Input(s) Output(s )
- 39. Feedback Loops:Best Case • Change is made on a file • Changes are tested as we type/save • Problem found immediately • Problem solved immediately Process Input(s) Output(s )
- 40. Where Do We Run Static Code Analysis? Best Okay Better
- 41. Where Do We Run Static Code Analysis? Best Test Server Better
- 42. Test Server
- 43. Test Server • Goal: Going to give us secure base • All tools run • All files • Slow Best Test Server Better
- 44. Test Server • Lots of options for this • Quickly talk about GitHub Actions • Quick to setup • “Infinitely” scaleable Best Test Server Better
- 45. Test Server • Two ways to setup • One Job For All Tools • Tools Run In Series • Multiple Jobs/Actions For Each Tool • Tools Run in Parallel Best Test Server Better
- 49. Where Do We Run Static Code Analysis? Best Test Server Better
- 50. Where Do We Run Static Code Analysis? Best Test Server Pre-Commit
- 51. Before Commit Is Created
- 52. Before Commit Is Created • Build off secure base • Balance of tools • Changed files only • Faster Best Test Server Pre-Commit
- 53. Before Commit Is Created: How? • Run files manually • Copy and paste each file • Skip this step SO fast Best Test Server Pre-Commit
- 54. Before Commit Is Created: How? • Run files automatically • Use pre-commit functionality Best Test Server Pre-Commit
- 56. commit-msg
- 57. pre-push
- 58. pre-commit
- 59. Pre-Commit Script git add . git commit -m “changes” Commit Created
- 60. Pre-Commit Script git add . git commit -m “changes” Commit Created Pre-commit Denied
- 61. Pre-Commit Script Our Pre-commit script’s goals: 1. Give us fast feedback loop 2. Only run on files we changed 3. Run as many tools as possible
- 62. Only run on files we changed?
- 63. Pre-Commit Script git diff —diff-filter=AM —name-only —cached app tests | grep ".php$"
- 64. Pre-Commit Script function __runStaticTool() #(name, command) { echo -e "nn$1" output=$(eval "$2" 2>&1) exitcode=$? if [[ 0 == $exitcode || 130 == $exitcode ]]; then echo -e "Success" else echo -e "Failurenn$output" exit 1 fi }
- 65. Pre-Commit Script #!/usr/bin/env bash function __runStaticTool() #(name, command) { ... } modified="git diff --diff-filter=AM --name-only --cached app tests | grep ".php$"" __runStaticTools "PHP_CodeSniffer" "${modified} | xargs vendor/bin/phpcs --standard=PSR12
- 66. Pre-Commit Script #!/usr/bin/env bash function __runStaticTool() #(name, command) { ... } modified="git diff --diff-filter=AM --name-only --cached app tests | grep ".php$"" __runStaticTools "PHP_CodeSniffer" "${modified} | xargs vendor/bin/phpcs --standard=PSR12 __runStaticTools "phpstan" "${modified} | xargs vendor/bin/phpstan analyze
- 70. Pre-Commit Script • Located at .git/hooks/pre-commit • NOT part of repo • Can be skipped
- 71. Pre-Commit Script • Keep copy in “scripts” directory • Use composer to install everywhere
- 72. Where Do We Run Static Code Analysis? Best Test Server Pre-Commit
- 73. Where Do We Run Static Code Analysis? IDE Test Server Pre-Commit
- 74. IDE • Build off secure base • Smaller Number of tools • Changed files • Immediate feedback IDE Test Server Pre-Commit
- 75. IDE: Top Suggestions • Errors out in public • Don’t ignore them • Look for integrations/extensions
- 77. Where Do We Run Static Code Analysis? IDE Test Server Pre-Commit
- 78. Tools
- 81. Types of SCA Tools 1. Bug Reduction 2. Rule Validation 3. Code Analysis
- 82. Types of SCA Tools 1. Bug Reduction 2. Rule Validation 3. Code Analysis
- 83. Focus: Scott’s Favorites 1. Free 2. Easy to use 3. Command line based
- 84. Linting
- 85. Is Our Code Valid?
- 87. Linting find -L src tests -name '*.php' -print0 | xargs -0 -n 1 -P 4 php -l
- 88. Linting • src/Location/City.php • src/Name/FirstName.php • src/Name/LastName.php
- 90. PHP Parallel Lint • composer require --dev php-parallel-lint/php-parallel-lint • ./vendor/bin/parallel-lint src tests
- 94. Grep • Debugging only functions • var_dump() • exit • dd()
- 95. Grep • In most Unix environments by default • grep “thing we don’t want” src tests
- 97. Coding Standard
- 99. Coding Standard
- 101. PHP_CodeSniffer • phpcs -> validates code • phpcbf -> fixes code (when possible)
- 102. PHP_CodeSniffer 1. Existing coding standards: PSR12, Pear, Zend, etc 2. Create from scratch 3. Existing + Extras
- 103. phpcs.xml v 1.0 <?xml version="1.0"?> <ruleset name=“Super PSR12"> <description> PSR12 + Types</description> <rule ref=“PSR12" /> </ruleset>
- 104. phpcs.xml v 1.0 ./vendor/bin/phpcbf --standard=phpcs.xml src tests
- 105. phpcs.xml v 1.0
- 106. –You (Maybe) “How does this prevent bugs?”
- 107. Example
- 108. Example int(3)
- 110. Example 1.25 + 2.75 (int)1.25 + (int)2.75 1 + 2 3
- 111. Fix
- 112. RequireStrictTypes Fatal error: Uncaught TypeError: add(): Argument #1 ($a) must be of type int, float given, called in /home/user/scripts/code.php on line 9 and defined in /home/user/scripts/code.php:5
- 113. phpcs.xml v 2.0 <?xml version="1.0"?> <ruleset name=“Super PSR+12"> <description> PSR12 + Types</description> <rule ref=“PSR12" /> <rule ref="Generic.PHP.RequireStrictTypes" /> </ruleset>
- 114. phpcs.xml v 2.0 1 | ERROR | Missing required strict_types declaration
- 115. Slevomat Coding Standard • Slevomat Coding Standard library • composer require --dev "slevomat/coding-standard"
- 116. phpcs.xml v 2.0 <?xml version="1.0"?> <ruleset name=“Super PSR+12"> <description> PSR12 + Types</description> <rule ref=“PSR12" /> <rule ref="Generic.PHP.RequireStrictTypes" /> <rule ref="SlevomatCodingStandard.TypeHints.PropertyTypeHint" /> <rule ref="SlevomatCodingStandard.TypeHints.ReturnTypeHint" /> <rule ref="SlevomatCodingStandard.TypeHints.ParameterTypeHint" /> </ruleset>
- 118. Bug Finders
- 119. Bug Finders
- 120. Bug Finders
- 121. Bug Finders Fatal error: Uncaught Error: Cannot access private property User::$id
- 123. PHPStan • Finds bugs in our code • Check “correctness” of each line
- 124. PHPStan: Setup • Install • Composer require --dev phpstan/phpstan • Running • vendor/bin/phpstan analyse -l <number> src tests
- 125. PHPStan: Rule Levels • Specify level of strictness using -l|--level parameter • 0 -> Low Strictness • 9 -> High Strictness
- 132. parameters: ignoreErrors: - message: "#^Access to private property …::$id.$#” count: 1 path: src/Location/User.php
- 134. PHPStan: Getting Started 1. Generate baseline at level 0 2. Fix all errors at current level 3. Increase level 4. Repeat until desired level
- 137. PHP 7.4 To 8.0 Was Challenging
- 138. Automating Refactoring • Create a branch with PHP 8 installed • Run through our tests • Have someone manually fix the error
- 139. What if We Automate This?
- 141. Rector • Install • composer require rector/rector --dev • Create configuration • ./vendor/bin/rector init
- 142. Rector:rector.php
- 143. Rector:rector.php
- 144. Rector:rector.php
- 145. Rector:rector.php
- 146. Rector:rector.php
- 147. Rector:rector.php
- 148. Rector: example
- 149. Rector: example Fatal error: Uncaught Error: Call to undefined function create_function()
- 152. Rector: example • Run manually locally • OR • Add to GitHub Action
- 153. Rector: Other Sets
- 154. Rector: Other Sets
- 155. Rector: Other Sets
- 156. Production Part 3: Code Readability/Maintainability Change Dynamic Automated Tests Static Lint phpcs PHPStan grep Rector
- 157. What You Need to Know
- 158. What You Need to Know Static Code Analysis allows us to analyze our code without running it
- 159. What You Need to Know Process Input(s) Output(s)
- 160. What You Need to Know IDE Test Server Pre-Commit
- 161. What You Need to Know • PHP Parallel Lint • Grep • PHP_CodeSniffer • PHPStan • Rector
- 162. Questions? • Scott Keck-Warren • Url for resources
Editor's Notes
- Note: add QR code to slides/resources Note: QR code/link brings you to resources about this talk and slides Hello Developers,
- Story time Want to tell you about some of the trama I had inflicted on me Hopefully prevent you from having the same
- First job as a professional developer Small SaaS 3 developers No source control to speak of
- Bugs in productions were fixed like this Go through steps <click for each> Last part was important because we would occasionally find <next slide>
- Chrome with white screen Sometimes 1 page some times the whole site
- Generally results in angry person on phone (get picture of this) Asking “what happened?” SSH into the server to check error logs
- Miscopied our results
- Add example code with undefined function Copied changes to one file but not another
- Other things Happened at least once a week sometimes multiple times a day
- Graphic: Change -> Production directly So close together barely and space between them Need to add some space <click>
- Change -> ? -> Production When what do we fill the space with? Change -> Checks -> Production
- Better yet we’ll use two different types of checks
- Better still will use several different checks of each type Let’s talk about one of the mojor types today … <click>
- static code analysis Specifically: How we can reduce bugs with SCA
- For those of you who haven’t met me my name is …
- Professional PHP Developer for 15 years // team lead/CTO role for 10 of those 15
- Currently Director of Technology at WeCare Connect Survey solutions to improve employee and resident retention at skilled nursing facilities Use PHP for our backend Also …
- Create Educational Videos on PHPArchitect YouTube
- Discuss topics helpful for PHP developers
- Found at youtube.com/c/phparch If you want more content like this session follow me on social media and subscriber to our channel
- I’m a huge fan of both
- See my other talk on how to get more DCA
- I’m a huge fan of both See my other talk on how to get more DCA
- Lots of things we’ll do with static code analysis Read list
- <bp1> Currently have a team of 1 using it (me) Have had teams of 8 using it <bp2> In the past Have run into situations where our team has been waiting for their tests to run So easy today to spin up containers no longer a problem
- <slide> But Before we talk about that we need to talk about …
- <slide>
- Start with a process Could be anything writing a class, sending an email, checking your email
- Process has one or more inputs
- Process happens and we get one or outputs
- In a feedback loop the outputs become part of the import loop Developers Are Driven By Feedback Loops Make a change, find a problem, fix the problem, repeat Want these to be short -> We can affect the length Let’s give some examples
- First case is “Worst Case”
- In this <read slide> I’m lucky if I remember what I did be Note lack of testing
- Next option okay case <read slide> Less of a difference between change and problem being found
- Next best case <read slide> I like to call this an immediate feedback cycle Provides feedback immediately so we can resolve problems immediately This is the ultimate goal for static code analysis
- Using these feedback levels to build three tiers of static code analysis <click for each piece> At the bottom…<click>
- is running the SCA tools using a test server
- <Read slide> Slow is fine here my day job takes 30 minutes to run all static and dynamic analysis Fine with that because not watching
- Whole talk on working with GitHub actions you’re not seeing because it’s happening right now Have video php arch channel on how to setup
- Graph from before showing us change to production I like 1 action with a lot of small steps in four stages
- 1 dynamic stage where I run automated tests
- 3 static stages Quick and easy first to fail fast in first stages Slow in final stages Saves some money and failing items in earlier phase generally cause failures in later stages
- Return to our chart See what’s next
- Two ways to do this First <slide>
- Inside our .git directory then hooks Session on this if you’re interesting we’re doing the quick-quick version
- -> Default commit message
- -> before we push
- -> before commit is created
- This is normally how we create commit
- Pre-commit adds a conditional check Is this good yes or no -> no we can’t create the commit
- Might be wondering how ..
- 1. `git diff` -> Runs the git diff command which shows us changes in our repository 2. `--diff-filter=AM` -> filters out files to only show us modifications and additions 3. `--name-only` -> returns just the name of the file and not the contents 4. `--cached` -> returns changes that have been staged for the next commit and not every changed file 5. `app tests` -> limit our results to files in the app and tests directories 6. `| grep ".php$"` -> Limit our results to just `.php` files
- Example graphic at command line
- Example graphic in VScode
- Example output in VScode
- Still can be bypassed Which is why we have secure base at the test server
- VS Code example of syntax error: Missing “use” statement Not native but with error lens plugin Love these which is why I need to restart VScode so frequently
- Here’s where it get good Too many PHP SCA tools to review them all here
- Show graphic of git repo with list of SCA tools https://github.com/exakat/php-static-analysis-tools
- https://analysis-tools.dev/tag/php
- Bug Reduction -> things that might break code Rule Validation -> things that don’t meet our standards Code Analysis -> What’s code like
- Focus on first two here Third one is something I do weekly to see our code health but not automatically in 3-tiers
- Free Easy to use Everything is command line based so it runs at pre-commit and test server
- The most important SCA tool
- Linting answers the most important question about our code
- Built in linting mode 1 file at a time “slow” because of that
- Have to run it through additional tools
- Also only finds one problem at a time So error in city and last name Only show error in city Fix and repeat to find second
- https://packagist.org/packages/php-parallel-lint/php-parallel-lint php-parallel-lint/php-parallel-lint
- Example running parrellel lint
- Graphics here Like to make this my first check If it fails others will fail as well
- Another basic check “free”
- Pushing these to production causes weird output Can and does break site Don’t want it that
- Pushing these to production causes weird output Can and does break site Don’t want it that
- Where in graphic
- Teams are comprised of people with lots of life experience and thramas That affects how they type each character
- Having a coding standard makes code easier to read Without a coding standard can have chaos How do we fix this? Better how do we fix this automatically
- PHP_CodeSniffer library allows us to define standard, enforce it, and fix it
- PHP_CodeSniffer library has two command line scripts PHP CodeSniffer PHP Code Block Fixer
- We need tell php_codesniffer what rules to use <slide> I like third option PSR12 as a base PSR family of standards is used by a lot of frameworks so it’s helpful
- Created at root of project
- Created at root of project
- If we run phpcbf on code this is what we get Better right or at least consistent
- <Read slide> Let’s take a slight detour for another example
- Function that adds two numbers Use it to add 1.25 and 2.75 Does anyone know what the output of this is?
- That seems like a bug to me what about you?
- This is due to something that PHP does called type juggling Because dynamic language it automatically converts types We wanted int so it gave us ints Mostly great but sometimes weird bugs
- <click> have our two numbers <click> We specified int parameters to our function php said I’m going to make these integers <click> PHP converts number to integers and in this case strips out the fractions <click> 3
- December 2015 PHP 7 added this declare function - Prevents this kind of bug 7 years ago If we run our code again <next slide>
- We get type error I constantly forget to add strict_types to my code Need a little help PHP_Codesniffer provides that
- Doesn’t work by magic also need to make sure parameter types No support out of box for this
- To do that we need to look for more rules (or sniffs as code sniffer calls them) <Read slide>
- Next require parameter types hints Without parameter types strict types doesn’t help us completely Return and property types aid in us making these kinds of mistakes (also helps other tools)
- Let’s review where we’re at Still have a space need to discuss and that’s
- Help us find fatal errors due to changes in our code or mistakes
- Have a very basic user class Somewhere in my code I need the ID
- Have a very basic user class Somewhere in my code I need the ID
- Running first time on brownfield application Potentially lots of “problems”
- Run with —generate-baseline Only need to worry about changes
- Have a pipeline now This works and works because we
- Graphic
- At least of some of us Took weeks Might still have projects running on 7.4 because can’t justify upgrade
- Took FOREVER Full of potential errors because shortcuts were made Didn’t even get to implement the new features in 8.0 like Constructor Property Promotion Upgrade to 8.1 took less time but still a while 8.2 might take just a bit because we haven’t done it yet
- Lot’s of manual work
- Rector
- List of rules and sets of rules can be found on their website
- LevelSetList::UP_TO_PHP_80 is amazing because it will upgrade our code to 8.0 when possible Ready to go to 8.1? <click>
- Ready to go to 8.1? Just change it
- Keep your feedback loop SHORT Immediately if possible
- Run tools In IDE Pre-commit Test Server
- Lots of options for tools My favorites:
- Add QR code here