Skip to main content
PHPStan is a static analysis tool for PHP. CodeRabbit runs PHPStan version 2.2.8.

​
Files

PHPStan will run on files with the following extensions:
  • .php

​
Configuration

PHPStan is enabled by default. Enable or disable it and set its rule level with .coderabbit.yaml or the CodeRabbit web UI:
.coderabbit.yaml
The level option accepts default, 0 through 9, or max and defaults to default. With default, CodeRabbit uses level 3 in Chill mode and level 8 in Assertive mode. A level: value in the repository’s PHPStan config takes precedence over this setting. PHPStan supports the following config files:
  • phpstan.neon
  • phpstan.neon.dist
  • phpstan.dist.neon
If no PHPStan config file is found, CodeRabbit writes a temporary config based on the selected review profile.

​
What CodeRabbit runs

PHPStan runs in a sandbox with the project config if present. If a project config is present, we parse and validate the config before execution.

​
Analysis scope

CodeRabbit-generated config files always set paths: to the changed-file scope. For repository-provided config files, CodeRabbit narrows paths: to changed files only when composer.json is present and Composer dependency installation succeeds. Otherwise, CodeRabbit keeps the analysis paths declared by the config file to avoid false unresolved-symbol findings. For large changed-file sets, CodeRabbit analyzes the files in bounded parts and combines the findings.

​
Composer dependencies

When a repository-provided config file needs Composer dependencies for symbol resolution, CodeRabbit installs them in the review sandbox. During installation, Composer uses a writable cache inside the review sandbox. After 120 seconds, Composer installation stops. After the run, CodeRabbit removes the PHPStan and Composer cache directories.

​
When Composer setup fails

If Composer dependency installation fails, the review explains the failure. The message distinguishes private-package access, dependency resolution, outdated lock files, unreachable registries, unavailable packages, sandbox cache failures, timeouts, and unclassified failures. It does not expose raw package names or host names. When private dependencies are not accessible, disable the built-in PHPStan check and rely on PHPStan output from your own CI pipeline instead.

​
Profile behavior

  • With level: default and a generated config, Chill uses level 3 and reports findings as errors.
  • With level: default and a generated config, Assertive uses level 8 and reports findings as warnings.
When CodeRabbit generates the PHPStan config, both profiles ignore these identifiers:
  • constructor.unusedParameter
  • closure.unusedUse
  • class.nameCase
  • method.nameCase
  • phpDoc.parseError
  • phpDoc.phpstanTag
  • return.phpDocType
  • missingType.generics
  • missingType.iterableValue
  • phpDoc.variance
  • generics.variance
  • class.notFound
  • method.notFound
  • function.notFound
  • attribute.notFound
  • property.notFound
  • variable.undefined
The generated Assertive config additionally ignores:
  • method.unused
  • classConstant.unused
  • property.unused
  • return.unusedType
  • property.unusedType
  • trait.unused
  • missingType.return
  • missingType.parameter
  • missingType.property
  • missingType.callable
CodeRabbit always filters property.notFound and variable.undefined from review comments, including when the repository supplies its own config.

​
Security policy and restrictions

  • We reject phpstan.neon/phpstan.neon.dist that declare bootstrapFile or bootstrapFiles to prevent executing arbitrary project bootstrap code.
  • Blocked configuration keys include:
    • bootstrapFiles
    • bootstrapFile
  • If a config declares includes:, CodeRabbit does not resolve the included files. It discards the repository config and uses a generated profile config for the run.
  • Composer dependency installation disables plugins and scripts.

​
When we skip PHPStan

CodeRabbit will skip running PHPStan when:
  • The config file does not contain a paths: parameter.
  • The config contains bootstrapFile or bootstrapFiles.
  • PHPStan is already running in GitHub Actions, GitLab CI, CircleCI, or Azure Pipelines.
  • Config parsing fails or appears unsafe.
Use this skip list together with Composer failure reporting and the analysis scope to understand whether PHPStan runs and which files it analyzes.