Vateron-Media/XC_VM
1
0
Fork 0
mirror of https://github.com/Vateron-Media/XC_VM.git synced 2026-10-29 19:03:29 +01:00
Code Issues 1 Packages Projects Releases 6 Wiki Activity
Files
7e5732cdcbad9540e4009adc73de302aa4bab01c
XC_VM/phpstan.dist.neon
T
Divarion-D 7e5732cdcb chore(psr4): phase 0 — Composer PSR-4 autoloader foundation 
Introduce a committed Composer PSR-4 autoloader without changing class
resolution behavior, as the foundation for the incremental PSR-4 migration.

- src/composer.json: PSR-4 (XcVm\ -> ./, M3uParser\, Chrisyue\PhpM3u8\),
  platform php 8.1.33 (deploy runtime), optimize-autoloader/classmap-authoritative
  false (live path resolution, no class-map cache). autoload.files left empty:
  global functions are still loaded by existing require glue; moving them is
  deferred until that glue is removed.
- src/vendor/ + src/composer.lock: committed (deploy path has no Composer);
  generated with 'composer update' from src/. Regenerate with dump-autoload.
- src/bootstrap.php, tests/bootstrap.php: require vendor/autoload.php first,
  then the legacy autoload.php.
- src/autoload.php: drop the igbinary disk cache (enableFileCache/saveCache/
  shutdown handler/root-chown + bottom call); register at the END of the SPL
  queue (prepend=false) so Composer wins for XcVm\* and only still-global
  classes fall through to the in-memory scanner.
- Makefile: add vendor to LB_DIRS so load-balancer archives ship the loader.
- phpstan.dist.neon: exclude src/vendor/* from analysis.
- .gitignore: document that src/vendor/ is intentionally tracked.
- ci.yml: add composer-audit job (no-op until real require deps exist).

Verified: php -l clean; Composer first / XC_Autoloader last in the SPL stack;
tmp/cache/autoload_map no longer written; PHPUnit 292/292; PHPStan no errors.
2026-06-24 19:07:37 +03:00

224 lines
7.2 KiB
Plaintext
Raw Blame History

parameters:
# Start low for a legacy codebase, then raise one step at a time (0 → max).
# Every increment surfaces a new class of issues; fix or baseline, then bump.
level: 5
phpVersion: 80300
# Entry points to analyze. Add/remove dirs as the audit progresses.
paths:
- src/core
- src/domain
- src/infrastructure
- src/streaming
- src/modules
- src/cli
# No Composer + no namespaces. The bootstrap only defines global constants;
# it does NOT run the project autoloader (that would force a live directory
# rescan per class miss and crash the workers). PHPStan resolves every
# symbol statically from `paths` + `scanDirectories` below.
bootstrapFiles:
- tools/phpstan/phpstan-bootstrap.php
# Listed directly (not just require'd from the bootstrap) so PHPStan
# tracks it for result-cache invalidation when constants change.
- tools/phpstan/constants.stub.php
# Indexed for symbol resolution (classes/interfaces/functions defined here
# are findable) but NOT reported on directly. These cover every source dir
# outside `paths` so cross-references always resolve.
scanDirectories:
- src/public
- src/signals
- src/ministra
- src/content
- src/resources
- src/config
- src/migrations
# Root files holding global classes (XC_Bootstrap, XC_Autoloader) referenced
# across the codebase but living outside any scanned directory.
scanFiles:
- src/autoload.php
- src/bootstrap.php
excludePaths:
analyse:
- src/*/tmp/*
- src/tmp/*
- src/backups/*
# Composer autoloader glue (committed + shipped, generated code).
- src/vendor/*
# Vendored third-party library shipped inside core
- src/core/Parsing/M3uParser/*
# View templates: included into a controller's scope, so their
# variables ($rSettings, $language, ...) are injected by the caller.
# PHPStan analyses files standalone and would flag every such var as
# undefined — not real bugs. (Still indexed via scanDirectories.)
- src/modules/*/views/*
treatPhpDocTypesAsCertain: false
reportUnmatchedIgnoredErrors: false
# These constants are defined at runtime with values that vary by
# deployment; tell PHPStan to use their type, not the literal value the
# stub happens to set (otherwise comparisons read as always true/false).
dynamicConstantNames:
- ARCHIVE_PATH
- BIN_PATH
- BUFFER_SIZE
- CACHE_TMP_PATH
- CIDR_TMP_PATH
- CLIENT_BANNED
- CLIENT_DISABLED
- CLIENT_DISALLOWED
- CLIENT_EXPIRED
- CLIENT_INVALID
- CLIENT_IS_E2
- CLIENT_IS_MAG
- CLIENT_IS_STALKER
- CLOSE_EMPTY
- CONFIG_PATH
- CONS_TMP_PATH
- CONTENT_PATH
- CREATED_PATH
- CRONS_TMP_PATH
- DB_ACCESS_ENABLED
- DELAY_PATH
- DEV_MODE
- DIVERGENCE_TMP_PATH
- E2_IMAGES_PATH
- EPG_PATH
- FFMPEG
- FFMPEG_BIN_40
- FFMPEG_BIN_71
- FFMPEG_BIN_80
- FFMPEG_FONT
- FFPROBE
- FFPROBE_BIN_40
- FFPROBE_BIN_71
- FFPROBE_BIN_80
- FLOOD_TMP_PATH
- GEOISP_BIN
- GEOLITE2_BIN
- GEOLITE2C_BIN
- GIT_OWNER
- GIT_REPO_BIN
- GIT_REPO_MAIN
- GIT_REPO_UPDATE
- HOST
- IMAGES_PATH
- KEYFRAME_HEADER
- LINES_TMP_PATH
- LOGS_TMP_PATH
- MAIN_HOME
- MAX_PREBUFFER
- MAX_SEG_BYTES
- MINISTRA_TMP_PATH
- MIN_SEG_PTS
- MONITOR_CALLS
- OPENSSL_EXTRA
- PACKET_SIZE
- PAGE_NAME
- PAT_HEADER
- PAT_PERIOD
- PHP_BIN
- PHP_ERRORS
- PLAYER_BOOTSTRAP_DONE
- PLAYER_TMP_PATH
- PLAYLIST_PATH
- SEGMENT_DURATION
- SERIES_TMP_PATH
- SERVER_ID
- SIGNALS_PATH
- SIGNALS_TMP_PATH
- STATUS_CERTBOT
- STATUS_CERTBOT_INVALID
- STATUS_CERTBOT_RUNNING
- STATUS_CODE_LENGTH
- STATUS_DISABLED
- STATUS_EXISTS_CODE
- STATUS_EXISTS_DIR
- STATUS_EXISTS_HMAC
- STATUS_EXISTS_IP
- STATUS_EXISTS_MAC
- STATUS_EXISTS_NAME
- STATUS_EXISTS_SOURCE
- STATUS_EXISTS_USERNAME
- STATUS_FAILURE
- STATUS_FLUSH
- STATUS_INSUFFICIENT_CREDITS
- STATUS_INVALID_CAPTCHA
- STATUS_INVALID_CODE
- STATUS_INVALID_DATA
- STATUS_INVALID_DATE
- STATUS_INVALID_DIR
- STATUS_INVALID_EMAIL
- STATUS_INVALID_FILE
- STATUS_INVALID_GROUP
- STATUS_INVALID_INPUT
- STATUS_INVALID_IP
- STATUS_INVALID_MAC
- STATUS_INVALID_NAME
- STATUS_INVALID_PACKAGE
- STATUS_INVALID_PASSWORD
- STATUS_INVALID_PLAYLIST
- STATUS_INVALID_SUBRESELLER
- STATUS_INVALID_TYPE
- STATUS_INVALID_USER
- STATUS_INVALID_USERNAME
- STATUS_NO_DESCRIPTION
- STATUS_NO_KEY
- STATUS_NO_SOURCE
- STATUS_NO_SOURCES
- STATUS_NOT_ADMIN
- STATUS_NO_TITLE
- STATUS_NOT_RESELLER
- STATUS_NO_TRIALS
- STATUS_RESERVED_CODE
- STATUS_SPACE_ISSUE
- STATUS_SUCCESS
- STATUS_SUCCESS_MULTI
- STATUS_SUCCESS_REPLACE
- STATUS_TOO_MANY_RESULTS
- STORAGE_PATH
- STORE_PREBUFFER
- STREAMS_PATH
- STREAMS_TMP_PATH
- TIMEOUT
- TIMEOUT_READ
- TMP_PATH
- VIDEO_PATH
- VOD_PATH
- WATCH_TMP_PATH
- XC_VM_VERSION
- YOUTUBE_BIN
# Documented FALSE POSITIVES that static analysis cannot resolve — NOT a
# baseline of real bugs. Each entry is unactionable by design.
ignoreErrors:
# Dynamic require/include built from absolute runtime paths
# (MAIN_HOME = /home/xc_vm/ on a deployed server). The files exist at
# deploy time; PHPStan cannot see them on a dev/CI checkout.
- identifier: requireOnce.fileNotFound
- identifier: include.fileNotFound
- identifier: require.fileNotFound
# Proprietary ioncube-encoded class, shipped only in licensed builds.
# Every call site is guarded with class_exists('XC_VM').
- '#unknown class XC_VM\.#'
# External vendor library (maxmind-db/reader), installed at runtime and
# not part of the source tree.
- '#MaxMind\\Db\\Reader#'
# ext-inotify stub is incomplete: inotify_init() really can return false
# (PHP manual), so the defensive check below is correct, not dead code.
-
message: '#=== between resource and false will always evaluate to false#'
path: src/streaming/AsyncFileOperations.php
includes:
# Pre-existing errors frozen so CI is green and only NEW code is checked.
# NOT a list of accepted bugs — most are false positives (DB-row shape
# narrowing, template vars) or cosmetic. Shrink over time and regenerate
# with `make phpstan-baseline` after fixing a batch.
- phpstan-baseline.neon
Reference in New Issue View Git Blame Copy Permalink