run phan alongside

Author: codemasher

.github/workflows/ci.yml

@@ -42,7 +42,7 @@ jobs:
         uses: shivammathur/setup-php@v2
         with:
           php-version: ${{ matrix.php-version }}
-          extensions: ${{ env.PHP_EXTENSIONS }}
+          extensions: ast, var_representation, ${{ env.PHP_EXTENSIONS }}
           ini-values: ${{ env.PHP_INI_VALUES }}
           coverage: none
 
@@ -55,6 +55,9 @@ jobs:
       - name: "Run PHP_CodeSniffer"
         run: php vendor/bin/phpcs -v
 
+      - name: "Run phan"
+        run: php vendor/bin/phan --target-php-version=${{ matrix.php-version }}
+
 #      - name: "Run PHPStan"
 #        run: php vendor/bin/phpstan
 

.phan/config.php

@@ -0,0 +1,56 @@
+<?php
+/**
+ * This configuration will be read and overlaid on top of the
+ * default configuration. Command-line arguments will be applied
+ * after this file is read.
+ */
+return [
+	// If this is set to `null`,
+	// then Phan assumes the PHP version which is closest to the minor version
+	// of the php executable used to execute Phan.
+	//
+	// Note that the **only** effect of choosing `'5.6'` is to infer
+	// that functions removed in php 7.0 exist.
+	// (See `backward_compatibility_checks` for additional options)
+	'target_php_version'              => null,
+	'minimum_target_php_version'      => '7.4',
+
+	// A list of directories that should be parsed for class and
+	// method information. After excluding the directories
+	// defined in exclude_analysis_directory_list, the remaining
+	// files will be statically analyzed for errors.
+	//
+	// Thus, both first-party and third-party code being used by
+	// your application should be included in this list.
+	'directory_list'                  => [
+		'examples',
+		'src',
+		'tests',
+		'vendor',
+	],
+
+	// A regex used to match every file name that you want to
+	// exclude from parsing. Actual value will exclude every
+	// "test", "tests", "Test" and "Tests" folders found in
+	// "vendor/" directory.
+	'exclude_file_regex'              => '@^vendor/.*/(tests?|Tests?)/@',
+
+	// A directory list that defines files that will be excluded
+	// from static analysis, but whose class and method
+	// information should be included.
+	//
+	// Generally, you'll want to include the directories for
+	// third-party code (such as "vendor/") in this list.
+	//
+	// n.b.: If you'd like to parse but not analyze 3rd
+	//       party code, directories containing that code
+	//       should be added to both the `directory_list`
+	//       and `exclude_analysis_directory_list` arrays.
+	'exclude_analysis_directory_list' => [
+		'vendor',
+	],
+	'suppress_issue_types'            => [
+		'PhanDeprecatedFunction',
+		'PhanAccessMethodInternal',
+	],
+];

composer.json

@@ -39,8 +39,9 @@
 		"ext-curl": "*",
 		"ext-json": "*",
 		"ext-sodium": "*",
+		"phan/phan": "^5.5.2",
 		"phpmd/phpmd": "^2.15",
-		"phpstan/phpstan": "^2.1.27",
+		"phpstan/phpstan": "^2.1.32",
 		"phpstan/phpstan-deprecation-rules": "^2.0.3",
 		"phpunit/phpunit": "^9.6",
 		"slevomat/coding-standard": "^8.23",
@@ -60,6 +61,7 @@
 		}
 	},
 	"scripts": {
+		"phan": "@php vendor/bin/phan",
 		"phpcs": "@php vendor/bin/phpcs",
 		"phpunit": "@php vendor/bin/phpunit",
 		"phpstan": "@php vendor/bin/phpstan",

src/Authenticators/HOTP.php

@@ -27,6 +27,7 @@
  */
 class HOTP extends AuthenticatorAbstract{
 
+	/** @phan-suppress-next-line PhanAccessOverridesFinalConstant */
 	public const MODE = self::HOTP;
 
 	public function getCounter(?int $data = null):int{