Static Analysis Tools for PHP

Docker image providing static analysis tools for PHP. The list of available tools and the installer are actually managed in the jakzal/toolbox repository.

Supported platforms and PHP versions

Docker hub repository: https://hub.docker.com/r/jakzal/phpqa/

Debian

• latest, debian (Dockerfile)
• 1.121.5, 1.121, 1.121.5-debian, 1.121-debian (Dockerfile)
• 1.121.5-php8.2, 1.121-php8.2, php8.2-debian, php8.2 (Dockerfile)
• 1.121.5-php8.3, 1.121-php8.3, php8.3-debian, php8.3 (Dockerfile)
• 1.121.5-php8.4, 1.121-php8.4, php8.4-debian, php8.4 (Dockerfile)
• 1.121.5-php8.5, 1.121-php8.5, php8.5-debian, php8.5 (Dockerfile)

Alpine

• alpine (Dockerfile)
• 1.121.5-alpine, 1.121-alpine, (Dockerfile)
• 1.121.5-php8.2-alpine, 1.121-php8.2-alpine, php8.2-alpine (Dockerfile)
• 1.121.5-php8.3-alpine, 1.121-php8.3-alpine, php8.3-alpine (Dockerfile)
• 1.121.5-php8.4-alpine, 1.121-php8.4-alpine, php8.4-alpine (Dockerfile)
• 1.121.5-php8.5-alpine, 1.121-php8.5-alpine, php8.5-alpine (Dockerfile)

Updated daily: latest, debian, alpine, php8.5, php8.5-alpine, etc. Updated on patch version change: 1.61, 1.61-php8.5, 1.61-php8.5-alpine, etc. Never updated: 1.61.0, 1.61.0-php8.5, 1.61.0-php8.5-alpine, etc.

Legacy

These are the latest tags for PHP versions that are no longer supported:

• 1.105.0-php8.1, 1.105-php8.1, php8.1-debian, php8.1 (Dockerfile)
• 1.105.0-php8.1-alpine, 1.105-php8.1-alpine, php8.1-alpine (Dockerfile)
• 1.92.7-php8.0, 1.93-php8.0, php8.0-debian, php8.0 (Dockerfile)
• 1.92.7-php8.0-alpine, 1.93-php8.0-alpine, php8.0-alpine (Dockerfile)
• 1.80.0-php7.4, 1.80-php7.4, php7.4-debian, php7.4 (Dockerfile)
• 1.80.0-php7.4-alpine, 1.80-php7.4-alpine, php7.4-alpine (Dockerfile)
• 1.61.2-php7.3, 1.61-php7.3, php7.3-debian, php7.3 (debian/Dockerfile)
• 1.61.2-php7.3-alpine, 1.61-php7.3-alpine, php7.3-alpine (alpine/Dockerfile)
• 1.44.0-php7.2, 1.44-php7.2, php7.2 (7.2/debian/Dockerfile)
• 1.44.0-php7.2-alpine, 1.44-php7.2-alpine, php7.2-alpine (7.2/alpine/Dockerfile)
• 1.26.0-php7.1, 1.26-php7.1, php7.1 (7.1/debian/Dockerfile)
• 1.26.0-php7.1-alpine, 1.26-php7.1-alpine, php7.1-alpine (7.1/alpine/Dockerfile)

Available tools

| Name | Description | PHP 8.2 | PHP 8.3 | PHP 8.4 | PHP 8.5 | | :--- | :---------- | :------ | :------ | :------ | :------ | | behat | Helps to test business expectations | ✅ | ✅ | ✅ | ✅ | | box | Fast, zero config application bundler with PHARs | ✅ | ✅ | ✅ | ✅ | | churn | Discovers good candidates for refactoring | ✅ | ✅ | ✅ | ✅ | | codeception | Codeception is a BDD-styled PHP testing framework | ✅ | ✅ | ✅ | ❌ | | composer | Dependency Manager for PHP | ✅ | ✅ | ✅ | ✅ | | composer-bin-plugin | Composer plugin to install bin vendors in isolated locations | ✅ | ✅ | ✅ | ✅ | | composer-lock-diff | Composer plugin to check what has changed after a composer update | ✅ | ✅ | ✅ | ✅ | | composer-normalize | Composer plugin to normalize composer.json files | ✅ | ✅ | ✅ | ✅ | | composer-require-checker | Verify that no unknown symbols are used in the sources of a package. | ❌ | ❌ | ✅ | ✅ | | composer-require-checker-3 | Verify that no unknown symbols are used in the sources of a package. | ✅ | ✅ | ✅ | ✅ | | composer-unused | Show unused packages by scanning your code | ✅ | ✅ | ✅ | ✅ | | cyclonedx-php-composer | Composer plugin to create Software-Bill-of-Materials (SBOM) in CycloneDX format | ✅ | ✅ | ✅ | ✅ | | dephpend | Detect flaws in your architecture | ✅ | ✅ | ✅ | ✅ | | deprecation-detector | Finds usages of deprecated code | ✅ | ✅ | ✅ | ✅ | | deptrac | Enforces dependency rules between software layers | ✅ | ✅ | ✅ | ✅ | | diffFilter | Applies QA tools to run on a single pull request | ✅ | ✅ | ✅ | ✅ | | ecs | Sets up and runs coding standard checks | ✅ | ✅ | ✅ | ✅ | | gherkin-lint-php | Gherkin linter for PHP | ✅ | ✅ | ✅ | ✅ | | infection | AST based PHP Mutation Testing Framework | ✅ | ✅ | ✅ | ✅ | | jack | Helps to upgrade outdated Composer dependencies incrementally | ✅ | ✅ | ✅ | ✅ | | kahlan | Kahlan is a full-featured Unit & BDD test framework a la RSpec/JSpec | ✅ | ✅ | ✅ | ✅ | | larastan | PHPStan extension for Laravel | ✅ | ✅ | ✅ | ✅ | | lines | CLI tool for quick metrics of PHP projects | ✅ | ✅ | ✅ | ✅ | | local-php-security-checker | Checks composer dependencies for known security vulnerabilities | ✅ | ✅ | ✅ | ✅ | | parallel-lint | Checks PHP file syntax | ✅ | ✅ | ✅ | ✅ | | paratest | Parallel testing for PHPUnit | ✅ | ✅ | ✅ | ✅ | | pdepend | Static Analysis Tool | ✅ | ✅ | ✅ | ✅ | | phan | Static Analysis Tool | ✅ | ✅ | ✅ | ✅ | | phive | PHAR Installation and Verification Environment | ✅ | ✅ | ✅ | ✅ | | php-cs-fixer | PHP Coding Standards Fixer | ✅ | ✅ | ✅ | ✅ | | php-fuzzer | A fuzzer for PHP, which can be used to find bugs in libraries by feeding them 'random' inputs | ✅ | ✅ | ✅ | ✅ | | php-semver-checker | Suggests a next version according to semantic versioning | ✅ | ✅ | ✅ | ✅ | | phpa | Checks for weak assumptions | ✅ | ✅ | ✅ | ✅ | | phparkitect | Helps to put architectural constraints in a PHP code base | ✅ | ✅ | ✅ | ✅ | | phpat | Easy to use architecture testing tool | ✅ | ✅ | ✅ | ✅ | | phpbench | PHP Benchmarking framework | ✅ | ✅ | ✅ | ✅ | | phpca | Finds usage of non-built-in extensions | ✅ | ✅ | ✅ | ✅ | | phpcb | PHP Code Browser | ✅ | ✅ | ✅ | ✅ | | phpcbf | [Automatically corrects coding standard violations](https://github.com/PHPCSStandards/PHP_Cod