Add PHPStan CI workflow and fix all level 9 errors.

mnapoli · mnapoli · commit d443d0abf9de · 2026-06-29T12:14:12.000+02:00
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -0,0 +1,34 @@
+name: CI
+
+on:
+    push:
+        branches: [main]
+    pull_request:
+
+jobs:
+    phpstan:
+        name: PHPStan
+        runs-on: ubuntu-latest
+        steps:
+            - name: Checkout
+              uses: actions/checkout@v6
+
+            - name: Setup PHP
+              uses: shivammathur/setup-php@v2
+              with:
+                  php-version: '8.3'
+                  tools: composer:v2
+                  coverage: none
+
+            - name: Cache Composer dependencies
+              uses: actions/cache@v5
+              with:
+                  path: ~/.composer/cache
+                  key: php-composer-locked-${{ hashFiles('composer.lock') }}
+                  restore-keys: php-composer-locked-
+
+            - name: Install dependencies
+              run: composer install --no-interaction --prefer-dist --no-progress
+
+            - name: PHPStan
+              run: vendor/bin/phpstan analyse --no-progress
diff --git a/src/Application.php b/src/Application.php
@@ -37,11 +37,13 @@ public function __construct()
 
     public function safeAddCommand(Command $command): ?Command
     {
+        // addCommand() exists since Symfony Console 7.4; add() was removed in later versions.
+        /** @phpstan-ignore function.alreadyNarrowedType */
         if (method_exists($this, 'addCommand')) {
-            // addCommand() exists since 7.4 and add() has been deprecated.
             return $this->addCommand($command);
         }
 
+        /** @phpstan-ignore method.notFound */
         return $this->add($command);
     }
 
diff --git a/src/BrefCloudClient.php b/src/BrefCloudClient.php
@@ -71,7 +71,10 @@ public static function getUrl(): string
      */
     public function getUserInfo(): array
     {
-        return $this->client->request('GET', '/api/v1/user')->toArray();
+        /** @var array{id: int, name: string, email: string} $result */
+        $result = $this->client->request('GET', '/api/v1/user')->toArray();
+
+        return $result;
     }
 
     /**
@@ -102,9 +105,12 @@ public function createDeployment(string $environment, array $config, string|null
         if ($awsAccountName) {
             $body['aws_account_name'] = $awsAccountName;
         }
-        return $this->client->request('POST', '/api/v1/deployments', [
+        /** @var array{deploymentId: int, message: string, url: string, credentials?: array{accessKeyId: string, secretAccessKey: string, sessionToken: string}, packageUrls?: array<string, string>} $result */
+        $result = $this->client->request('POST', '/api/v1/deployments', [
             'json' => $body,
         ])->toArray();
+
+        return $result;
     }
 
     public function startDeployment(int $deploymentId): void
@@ -129,7 +135,10 @@ public function startDeployment(int $deploymentId): void
      */
     public function getDeployment(int $deploymentId): array
     {
-        return $this->client->request('GET', "/api/v1/deployments/$deploymentId")->toArray();
+        /** @var array{deploymentId: int, status: string, message: string, error_message: string|null, url: string, app_url: string|null, logs: list<array{line: string, timestamp: int}>, outputs?: array<string, string>} $result */
+        $result = $this->client->request('GET', "/api/v1/deployments/$deploymentId")->toArray();
+
+        return $result;
     }
 
     public function pushDeploymentLogs(int $deploymentId, string $newLogs): void
@@ -189,7 +198,10 @@ public function markDeploymentFinished(
      */
     public function getEnvironment(int $id): array
     {
-        return $this->client->request('GET', '/api/v1/environments/' . $id)->toArray();
+        /** @var array{id: int, name: string, region: string|null, url: string|null, outputs: array<string, string>, app: array{id: int, name: string}, aws_account_id: int|null} $result */
+        $result = $this->client->request('GET', '/api/v1/environments/' . $id)->toArray();
+
+        return $result;
     }
 
     /**
@@ -208,11 +220,14 @@ public function getEnvironment(int $id): array
      */
     public function findEnvironment(string $teamSlug, string $appName, string $environment): array
     {
-        return $this->client->request('GET', '/api/v1/environments/find?' . http_build_query([
+        /** @var array{id: int, name: string, region: string|null, url: string|null, outputs: array<string, string>, app: array{id: int, name: string}, aws_account_id: int|null} $result */
+        $result = $this->client->request('GET', '/api/v1/environments/find?' . http_build_query([
             'teamSlug' => $teamSlug,
             'appName' => $appName,
             'environmentName' => $environment,
         ]))->toArray();
+
+        return $result;
     }
 
     public function removeEnvironment(int $environmentId): void
@@ -245,7 +260,10 @@ public function startCommand(int $environmentId, string $command): int
      */
     public function getCommand(int $id): array
     {
-        return $this->client->request('GET', "/api/v1/commands/$id")->toArray();
+        /** @var array{status: 'not_started'|'started'|'success'|'failed', output: string} $result */
+        $result = $this->client->request('GET', "/api/v1/commands/$id")->toArray();
+
+        return $result;
     }
 
     /**
@@ -256,7 +274,10 @@ public function getCommand(int $id): array
      */
     public function listAwsAccounts(): array
     {
-        return $this->client->request('GET', '/api/v1/aws-accounts')->toArray();
+        /** @var list<array{id: int, name: string, role_arn: string, team_id: int}> $result */
+        $result = $this->client->request('GET', '/api/v1/aws-accounts')->toArray();
+
+        return $result;
     }
 
     /**
@@ -267,7 +288,10 @@ public function listAwsAccounts(): array
      */
     public function listTeams(): array
     {
-        return $this->client->request('GET', '/api/v1/teams')->toArray();
+        /** @var list<array{id: int, name: string, slug: string}> $result */
+        $result = $this->client->request('GET', '/api/v1/teams')->toArray();
+
+        return $result;
     }
 
     /**
@@ -285,7 +309,10 @@ public function listTeams(): array
      */
     public function prepareConnectAwsAccount(int $teamId): array
     {
-        return $this->client->request('GET', '/api/v1/aws-accounts/connect?team_id=' . $teamId)->toArray();
+        /** @var array{region: string, template_url: string, stack_name: string, bref_cloud_account_id: string, unique_external_id: string, role_name: string|null} $result */
+        $result = $this->client->request('GET', '/api/v1/aws-accounts/connect?team_id=' . $teamId)->toArray();
+
+        return $result;
     }
 
     public function addAwsAccount(mixed $teamId, string $accountName, string $roleArn): void
diff --git a/src/Commands/ApplicationCommand.php b/src/Commands/ApplicationCommand.php
@@ -32,7 +32,9 @@ protected function parseStandardOptions(InputInterface $input): array
         $environment = $input->getOption('env');
         /** @var string|null $configFileName */
         $configFileName = $input->getOption('config');
-        $config = Config::loadConfig($configFileName, $environment, $input->getOption('team'));
+        /** @var string|null $overrideTeam */
+        $overrideTeam = $input->getOption('team');
+        $config = Config::loadConfig($configFileName, $environment, $overrideTeam);
 
         return [
             'appName' => $config['name'],
diff --git a/src/Commands/Command.php b/src/Commands/Command.php
@@ -96,7 +96,8 @@ private function writeErrorDetails(string $output): void
                 $errorDetails['errorMessage'],
             ]);
             if (isset($errorDetails['stackTrace']) && is_array($errorDetails['stackTrace'])) {
-                IO::verbose($errorDetails['stackTrace']);
+                $stackTrace = array_values(array_filter($errorDetails['stackTrace'], 'is_string'));
+                IO::verbose($stackTrace);
             }
         } catch (JsonException) {
             IO::writeln(Styles::red($output));
diff --git a/src/Commands/Connect.php b/src/Commands/Connect.php
@@ -84,7 +84,10 @@ protected function execute(InputInterface $input, OutputInterface $output): int
             ]);
 
             $question = new Question('Display name: ');
-            $question->setValidator(function (string $answer) use ($existingAccounts): string {
+            $question->setValidator(function (mixed $answer) use ($existingAccounts): string {
+                if (! is_string($answer) || $answer === '') {
+                    throw new Exception('Account name cannot be empty');
+                }
                 // Check if the name is already taken
                 foreach ($existingAccounts as $account) {
                     if ($account['name'] === $answer) {
diff --git a/src/Commands/Deploy.php b/src/Commands/Deploy.php
@@ -271,8 +271,12 @@ private function uploadArtifacts(array $config, array $packageUrls): void
 
         $archivePaths = [];
         foreach ($packageUrls as $id => $url) {
-            $package = $config['packages'][$id];
-            $archivePaths[$id] = $this->packageArtifact($id, $package['path'], $package['patterns']);
+            $package = $config['packages'][$id] ?? null;
+            if (! is_array($package) || ! isset($package['path'], $package['patterns']) || ! is_string($package['path']) || ! is_array($package['patterns'])) {
+                throw new Exception("Invalid package configuration for '$id'");
+            }
+            $patterns = array_values(array_filter($package['patterns'], 'is_string'));
+            $archivePaths[$id] = $this->packageArtifact($id, $package['path'], $patterns);
         }
 
         IO::spin('uploading');
diff --git a/src/Commands/SecretCreate.php b/src/Commands/SecretCreate.php
@@ -31,8 +31,11 @@ protected function execute(InputInterface $input, OutputInterface $output): int
     {
         // If --app and --team are provided, we can skip loading the config file
         if ($input->getOption('app') && $input->getOption('team')) {
+            /** @var string $appName */
             $appName = $input->getOption('app');
+            /** @var string $team */
             $team = $input->getOption('team');
+            /** @var string $environment */
             $environment = $input->getOption('env');
         } else {
             [
@@ -43,22 +46,29 @@ protected function execute(InputInterface $input, OutputInterface $output): int
 
             // Override app name if --app option provided
             if ($input->getOption('app')) {
-                $appName = $input->getOption('app');
+                $appOption = $input->getOption('app');
+                if (! is_string($appOption)) {
+                    throw new Exception('Invalid app name');
+                }
+                $appName = $appOption;
             }
         }
 
         // Get secret name (from argument or prompt)
         $name = $input->getArgument('name');
         if (empty($name)) {
             $question = new Question('Secret name: ');
-            $question->setValidator(function (?string $value): string {
-                if (empty($value)) {
+            $question->setValidator(function (mixed $value): string {
+                if (! is_string($value) || $value === '') {
                     throw new Exception('Secret name cannot be empty');
                 }
                 return $value;
             });
             $name = IO::ask($question);
         }
+        if (! is_string($name)) {
+            throw new Exception('Secret name cannot be empty');
+        }
 
         // Get secret value (from argument or prompt)
         $value = $input->getArgument('value');
@@ -67,6 +77,9 @@ protected function execute(InputInterface $input, OutputInterface $output): int
             $question->setHidden(true)->setHiddenFallback(false);
             $value = IO::ask($question);
         }
+        if (! is_string($value)) {
+            throw new Exception('Secret value cannot be empty');
+        }
 
         $brefCloud = new BrefCloudClient;
 
diff --git a/src/Components/ServerlessFramework.php b/src/Components/ServerlessFramework.php
@@ -32,8 +32,9 @@ public function deploy(int $deploymentId, string $environment, array $awsCredent
         if ($input->hasOption('force')) {
             $options[] = '--force';
         }
-        if ($input->hasOption('config') && $input->getOption('config')) {
-            $configFile = (string) $input->getOption('config');
+        $configOption = $input->getOption('config');
+        if ($input->hasOption('config') && is_string($configOption) && $configOption !== '') {
+            $configFile = $configOption;
             $options[] = '--config';
             $options[] = $configFile;
         } else {
@@ -170,10 +171,11 @@ private function retrieveOutputs(string $oslsPackage, string $environment, array
                 $url = substr($url, strlen('ANY - '));
             }
             if (!$url && isset($deployOutputs['endpoints']) && is_array($deployOutputs['endpoints'])) {
-                $url = reset($deployOutputs['endpoints']);
+                $firstEndpoint = reset($deployOutputs['endpoints']);
+                $url = is_string($firstEndpoint) ? $firstEndpoint : null;
             }
             // Special case for the `server-side-website` construct
-            if (isset($deployOutputs['website']['url']) && is_string($deployOutputs['website']['url'])) {
+            if (isset($deployOutputs['website']) && is_array($deployOutputs['website']) && isset($deployOutputs['website']['url']) && is_string($deployOutputs['website']['url'])) {
                 $url = $deployOutputs['website']['url'];
             }
             if (! isset($deployOutputs['Stack Outputs']) || ! is_array($deployOutputs['Stack Outputs'])) {
@@ -203,14 +205,7 @@ private function retrieveOutputs(string $oslsPackage, string $environment, array
                     $stackOutputs = $this->cleanupCfOutputs($stackOutputs);
 
                     $stackName = $stackMatches[1];
-                    if (! is_string($stackName)) {
-                        throw new Exception('Invalid stack name in the "serverless info" output');
-                    }
-
                     $region = $regionMatches[1];
-                    if (! is_string($region)) {
-                        throw new Exception('Invalid region in the "serverless info" output');
-                    }
 
                     return array_merge([
                         'stack' => $stackName,
@@ -249,17 +244,23 @@ private function serverlessExec(string $oslsPackage, string $command, string $en
     }
 
     /**
-     * @param array<string, string> $outputs
+     * @param array<mixed, mixed> $outputs
      * @return array<string, string>
      */
     private function cleanupCfOutputs(array $outputs): array
     {
-        return array_filter($outputs, function (string $name): bool {
-            if ($name === 'ServerlessDeploymentBucketName') return false;
-            if ($name === 'HttpApiId') return false;
-            if (str_contains($name, 'LambdaFunctionQualifiedArn')) return false;
-            return true;
-        }, ARRAY_FILTER_USE_KEY);
+        $result = [];
+        foreach ($outputs as $name => $value) {
+            if (! is_string($name) || ! is_string($value)) {
+                continue;
+            }
+            if ($name === 'ServerlessDeploymentBucketName') continue;
+            if ($name === 'HttpApiId') continue;
+            if (str_contains($name, 'LambdaFunctionQualifiedArn')) continue;
+            $result[$name] = $value;
+        }
+
+        return $result;
     }
 
     private function findErrorMessageInServerlessOutput(string $entireSlsOutput): string
diff --git a/src/Config.php b/src/Config.php
diff --git a/src/Token.php b/src/Token.php

Original file line number	Diff line number	Diff line change
`@@ -37,11 +37,13 @@ public function __construct()`
`37`	`37`
`38`	`38`	`public function safeAddCommand(Command $command): ?Command`
`39`	`39`	`{`
	`40`	`+ // addCommand() exists since Symfony Console 7.4; add() was removed in later versions.`
	`41`	`+ /** @phpstan-ignore function.alreadyNarrowedType */`
`40`	`42`	`if (method_exists($this, 'addCommand')) {`
`41`		`- // addCommand() exists since 7.4 and add() has been deprecated.`
`42`	`43`	`return $this->addCommand($command);`
`43`	`44`	`}`
`44`	`45`
	`46`	`+ /** @phpstan-ignore method.notFound */`
`45`	`47`	`return $this->add($command);`
`46`	`48`	`}`
`47`	`49`