introduce PHPStan static code analysis

.distignore

@@ -20,4 +20,5 @@
 /package.json
 /package-lock.json
 /phpcs.xml
+/phpstan.neon
 /phpunit.xml

.gitattributes

@@ -15,6 +15,6 @@
 /package.json       export-ignore
 /package-lock.json  export-ignore
 /phpcs.xml          export-ignore
+/phpstan.neon       export-ignore
 /phpunit.xml        export-ignore
 /tests              export-ignore
-

.github/workflows/test.yml

@@ -68,6 +68,23 @@ jobs:
           composer lint-js
           composer lint-css
 
+  phpstan:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: 8.4
+          tools: composer
+      - name: Install PHP dependencies
+        run: composer install --no-interaction --prefer-dist --no-scripts
+      - name: PHPStan
+        run: composer phpstan
+
   analysis:
     runs-on: ubuntu-latest
     steps:

composer.json

@@ -23,8 +23,10 @@
     "dealerdirect/phpcodesniffer-composer-installer": "^v1.2",
     "matthiasmullie/minify": "^1.3",
     "phpcompatibility/phpcompatibility-wp": "^2.1",
+    "phpstan/phpstan": "^2.1",
     "slowprog/composer-copy-file": "~0.3",
     "squizlabs/php_codesniffer": "^3.13",
+    "szepeviktor/phpstan-wordpress": "^v2.0",
     "wp-coding-standards/wpcs": "^3.3",
     "yoast/wp-test-utils": "^1.2"
   },
@@ -62,6 +64,9 @@
       "minifycss styles/liveticker.css > styles/liveticker.min.css",
       "minifyjs scripts/block.js > scripts/block.min.js",
       "minifyjs scripts/liveticker.js > scripts/liveticker.min.js"
+    ],
+    "phpstan": [
+      "phpstan analyse --memory-limit=1G"
     ]
   },
   "config": {

includes/class-scliveticker.php

@@ -441,7 +441,7 @@ private static function tick_html( string $time, string $title, string $content,
 			$content = do_shortcode( $content );
 		}
 
-		return '<li class="sclt-tick" data-sclt-tick-id="' . esc_attr( $id ) . '">'
+		return '<li class="sclt-tick" data-sclt-tick-id="' . esc_attr( (string) $id ) . '">'
 			. '<span class="sclt-tick-time">' . esc_html( $time ) . '</span>'
 			. '<span class="sclt-tick-title">' . esc_html( $title ) . '</span>'
 			. '<div class="sclt-tick-content">' . $content . '</div></li>';
@@ -463,7 +463,7 @@ public static function tick_html_widget( string $time, string $title, bool $high
 			$out .= ' class="sclt-widget-new"';
 		}
 		if ( $id > 0 ) {
-			$out .= ' data-sclt-tick-id="' . esc_attr( $id ) . '"';
+			$out .= ' data-sclt-tick-id="' . esc_attr( (string) $id ) . '"';
 		}
 		return $out . '>'
 			. '<span class="sclt-widget-time">' . esc_html( $time ) . '</span>'

includes/class-widget.php

@@ -78,7 +78,7 @@ public function widget( $args, $instance ) {
 			echo ' sclt-ajax" '
 				. 'data-sclt-ticker="' . esc_attr( $category ) . '" '
 				. 'data-sclt-limit="' . esc_attr( $count ) . '" '
-				. 'data-sclt-last="' . esc_attr( current_datetime()->getTimestamp() );
+				. 'data-sclt-last="' . esc_attr( (string) current_datetime()->getTimestamp() );
 		}
 		echo '"><ul class="sclt-widget">';
 

phpstan.neon

@@ -0,0 +1,10 @@
+parameters:
+  level: 5
+  paths:
+    - includes/
+    - stklcode-liveticker.php
+  ignoreErrors:
+    - message: '/^Constant SCLIVETICKER_(BASE|DIR) not found\.$/'
+      path: includes/
+includes:
+- vendor/szepeviktor/phpstan-wordpress/extension.neon