-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512

Hi,

It's time to work on upgrading phan, the PHP static analysis tool we use! The version of phan we were using was released over two years ago (0.8.0) - we're moving to 1.2.4 that was released less than a week ago. And the CI infrastructure is now in place to facilitate easy upgrades in the future.

The new version comes with lots of upstream bug fixes and feature requests. We're also able to get rid of our custom wrapper scripts that hacked around limitations in phan as well.

I've filed bugs for every extension in Gerrit to upgrade phan[1], including links to migration steps. For some extensions the upgrade will be trivial, but for others it will be rather involved. I do expect that we will likely find some bugs or missing features in phan, but now we should be able to file upstream issues in those cases since we're no longer running a super out of date version.

In the second extension I ran it against, it was able to find actual bugs (e.g. [2]). So I'm pretty hopeful that this will be an overall improvement.

The CI tutorial[3] has also been updated for the new-style phan setup.

Let me know if you have any questions/comments/etc.

[1] https://phabricator.wikimedia.org/maniphest/query/KxjdNDM65iNM/ [2] https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/4925 27 [3] https://www.mediawiki.org/wiki/Continuous_integration/Tutorials/Add_phan _to_a_MediaWiki_extension

- -- Legoktm