Skip to main content
PHPStan is a static analysis tool for PHP. CodeRabbit includes PHPStan version 2.2.14 in its sandbox and uses the Composer-installed vendor/bin/phpstan instead when available.

​
Files

PHPStan will run on files with the following extensions:
  • .php

​
Configuration

PHPStan is enabled by default. Enable or disable it and set its rule level with .coderabbit.yaml or the CodeRabbit web UI:
.coderabbit.yaml
The level option accepts default, 0 through 9, or max and defaults to default. With default, CodeRabbit uses level 3 in Chill mode and level 8 in Assertive mode. A level: value in the repository’s PHPStan config takes precedence over this setting. CodeRabbit looks for the following PHPStan config files in the repository root:
  • phpstan.neon
  • phpstan.neon.dist
  • phpstan.dist.neon
If no PHPStan config file is found, CodeRabbit writes a temporary config based on the selected review profile.

​
What CodeRabbit runs

PHPStan runs in a sandbox with the project config if present. If a project config is present, we parse and validate the config before execution.

​
Analysis scope

With a generated config, CodeRabbit passes the changed PHP files to PHPStan as the analysis scope. With a repository-provided config, CodeRabbit narrows analysis to changed files when a root composer.json is present and dependency installation succeeds. Without composer.json, CodeRabbit keeps the analysis paths declared by the repository config to avoid false unresolved-symbol findings. If Composer installation fails, PHPStan does not run. For large changed-file sets, CodeRabbit analyzes the files in bounded parts and combines the findings.

​
Composer dependencies

When the repository root contains composer.json, CodeRabbit installs Composer dependencies in the review sandbox, including when CodeRabbit generates the PHPStan config. Composer uses a writable cache inside the sandbox, and each installation attempt has a 120-second timeout. After analysis, CodeRabbit removes the PHPStan and Composer cache directories.

​
When Composer setup fails

If Composer dependency installation fails, the review explains the failure. The message distinguishes private-package access, dependency resolution, outdated lock files, unreachable registries, unavailable packages, sandbox cache failures, timeouts, and unclassified failures. It does not expose raw package names or host names. When private dependencies are not accessible, disable the built-in PHPStan check and rely on PHPStan output from your own CI pipeline instead.

​
Profile behavior

  • With level: default and a generated config, Chill uses level 3 and reports findings as errors.
  • With level: default and a generated config, Assertive uses level 8 and reports findings as warnings.
When CodeRabbit generates the PHPStan config, both profiles ignore these identifiers:
  • constructor.unusedParameter
  • closure.unusedUse
  • class.nameCase
  • method.nameCase
  • phpDoc.parseError
  • phpDoc.phpstanTag
  • return.phpDocType
  • missingType.generics
  • missingType.iterableValue
  • phpDoc.variance
  • generics.variance
  • class.notFound
  • method.notFound
  • function.notFound
  • attribute.notFound
  • property.notFound
  • variable.undefined
The generated Assertive config additionally ignores:
  • method.unused
  • classConstant.unused
  • property.unused
  • return.unusedType
  • property.unusedType
  • trait.unused
  • missingType.return
  • missingType.parameter
  • missingType.property
  • missingType.callable
CodeRabbit always filters property.notFound and variable.undefined from review comments, including when the repository supplies its own config.

​
Security policy and restrictions

  • We reject any supported PHPStan config that declares bootstrapFile or bootstrapFiles to prevent executing arbitrary project bootstrap code.
  • Blocked configuration keys include:
    • bootstrapFiles
    • bootstrapFile
  • If a config declares includes:, CodeRabbit does not resolve the included files. It discards the repository config and uses a generated profile config for the run.
  • Composer dependency installation disables plugins and scripts.

​
When we skip PHPStan

CodeRabbit will skip running PHPStan when:
  • PHPStan is disabled in your CodeRabbit configuration.
  • No supported changed PHP files remain in the sandbox worktree.
  • The config file does not contain a paths: parameter.
  • The config contains bootstrapFile or bootstrapFiles.
  • PHPStan is already running in GitHub Actions, GitLab CI, CircleCI, or Azure Pipelines.
  • Config parsing fails or appears unsafe.
Use this skip list together with Composer failure reporting and the analysis scope to understand whether PHPStan runs and which files it analyzes.