Static Analysis Tools for PHP

Docker image providing static analysis tools for PHP. The list of available tools and the installer are actually managed in the jakzal/toolbox repository.

Supported platforms and PHP versions

Docker hub repository: https://hub.docker.com/r/jakzal/phpqa/

Nightly builds: https://hub.docker.com/r/jakzal/phpqa-nightly/

Debian

latest, debian (Dockerfile)
1.98.0, 1.98, 1.98.0-debian, 1.98-debian (Dockerfile)
1.98.0-php8.1, 1.98-php8.1, php8.1-debian, php8.1 (Dockerfile)
1.98.0-php8.2, 1.98-php8.2, php8.2-debian, php8.2 (Dockerfile)
1.98.0-php8.3, 1.98-php8.3, php8.3-debian, php8.3 (Dockerfile)

Alpine

alpine (Dockerfile)
1.98.0-alpine, 1.98-alpine, (Dockerfile)
1.98.0-php8.1-alpine, 1.98-php8.1-alpine, php8.1-alpine (Dockerfile)
1.98.0-php8.2-alpine, 1.98-php8.2-alpine, php8.2-alpine (Dockerfile)
1.98.0-php8.3-alpine, 1.98-php8.3-alpine, php8.3-alpine (Dockerfile)

Updated daily: latest, debian, alpine, php8.4, php8.4-alpine, etc. Updated on patch version change: 1.61, 1.61-php8.4, 1.61-php8.4-alpine, etc. Never updated: 1.61.0, 1.61.0-php8.4, 1.61.0-php8.4-alpine, etc.

Legacy

These are the latest tags for PHP versions that are no longer supported:

1.92.7-php8.0, 1.93-php8.0, php8.0-debian, php8.0 (Dockerfile)
1.92.7-php8.0-alpine, 1.93-php8.0-alpine, php8.0-alpine (Dockerfile)
1.80.0-php7.4, 1.80-php7.4, php7.4-debian, php7.4 (Dockerfile)
1.80.0-php7.4-alpine, 1.80-php7.4-alpine, php7.4-alpine (Dockerfile)
1.61.2-php7.3, 1.61-php7.3, php7.3-debian, php7.3 (debian/Dockerfile)
1.61.2-php7.3-alpine, 1.61-php7.3-alpine, php7.3-alpine (alpine/Dockerfile)
1.44.0-php7.2, 1.44-php7.2, php7.2 (7.2/debian/Dockerfile)
1.44.0-php7.2-alpine, 1.44-php7.2-alpine, php7.2-alpine (7.2/alpine/Dockerfile)
1.26.0-php7.1, 1.26-php7.1, php7.1 (7.1/debian/Dockerfile)
1.26.0-php7.1-alpine, 1.26-php7.1-alpine, php7.1-alpine (7.1/alpine/Dockerfile)

Available tools

Name	Description	PHP 8.1	PHP 8.2	PHP 8.3
behat	Helps to test business expectations	✅	✅	✅
box	Fast, zero config application bundler with PHARs	❌	✅	✅
box-3	Fast, zero config application bundler with PHARs	✅	❌	✅
churn	Discovers good candidates for refactoring	✅	✅	✅
codeception	Codeception is a BDD-styled PHP testing framework	✅	✅	✅
composer	Dependency Manager for PHP	✅	✅	✅
composer-bin-plugin	Composer plugin to install bin vendors in isolated locations	✅	✅	✅
composer-normalize	Composer plugin to normalize composer.json files	✅	✅	✅
composer-require-checker	Verify that no unknown symbols are used in the sources of a package.	❌	✅	✅
composer-require-checker-3	Verify that no unknown symbols are used in the sources of a package.	✅	✅	✅
composer-unused	Show unused packages by scanning your code	✅	✅	✅
dephpend	Detect flaws in your architecture	✅	✅	✅
deprecation-detector	Finds usages of deprecated code	✅	✅	✅
deptrac	Enforces dependency rules between software layers	✅	✅	✅
diffFilter	Applies QA tools to run on a single pull request	✅	✅	✅
ecs	Sets up and runs coding standard checks	✅	✅	✅
infection	AST based PHP Mutation Testing Framework	✅	✅	✅
larastan	PHPStan extension for Laravel	✅	✅	✅
local-php-security-checker	Checks composer dependencies for known security vulnerabilities	✅	✅	✅
parallel-lint	Checks PHP file syntax	✅	✅	✅
paratest	Parallel testing for PHPUnit	✅	✅	✅
pdepend	Static Analysis Tool	✅	✅	✅
pest	The elegant PHP Testing Framework	✅	✅	✅
phan	Static Analysis Tool	✅	✅	✅
phive	PHAR Installation and Verification Environment	✅	✅	✅
php-coupling-detector	Detects code coupling issues	❌	❌	❌
php-cs-fixer	PHP Coding Standards Fixer	✅	✅	✅
php-fuzzer	A fuzzer for PHP, which can be used to find bugs in libraries by feeding them 'random' inputs	✅	✅	✅
php-semver-checker	Suggests a next version according to semantic versioning	✅	✅	✅
phpa	Checks for weak assumptions	✅	✅	✅
phparkitect	Helps to put architectural constraints in a PHP code base	✅	✅	✅
phpat	Easy to use architecture testing tool	✅	✅	✅
phpbench	PHP Benchmarking framework	✅	✅	✅
phpca	Finds usage of non-built-in extensions	✅	✅	✅
phpcb	PHP Code Browser	✅	✅	✅
phpcbf	Automatically corrects coding standard violations	✅	✅	✅
phpcodesniffer-composer-install	Easy installation of PHP_CodeSniffer coding standards (rulesets).	✅	✅	✅
phpcov	a command-line frontend for the PHP_CodeCoverage library	❌	✅	✅
phpcpd	Copy/Paste Detector	✅	✅	✅
phpcs	Detects coding standard violations	✅	✅	✅
phpcs-security-audit	Finds vulnerabilities and weaknesses related to security in PHP code	✅	✅	✅
phpdd	Finds usage of deprecated features	✅	✅	✅
phpDocumentor	Documentation generator	✅	✅	✅
phpinsights	Analyses code quality, style, architecture and complexity	✅	✅	✅
phplint	Lints php files in parallel	✅	✅	✅
phploc	A tool for quickly measuring the size of a PHP project	✅	✅	✅
phpmd	A tool for finding problems in PHP code	✅	✅	✅
phpmetrics	Static Analysis Tool	✅	✅	✅
phpmnd	Helps to detect magic numbers	✅	✅	✅
phpspec	SpecBDD Framework	✅	❌	❌
phpstan	Static Analysis Tool	✅	✅	✅
phpstan-banned-code	PHPStan rules for detecting calls to specific functions you don't want in your project	✅	✅	✅
phpstan-beberlei-assert	PHPStan extension for beberlei/assert	✅	✅	✅
phpstan-deprecation-rules	PHPStan rules for detecting deprecated code	✅	✅	✅
phpstan-doctrine	Doctrine extensions for PHPStan	✅	✅	✅
phpstan-ergebnis-rules	Additional rules for PHPstan	✅	✅	✅
phpstan-exception-rules	PHPStan rules for checked and unchecked exceptions