Urgent PHP #1: generics, mago, the pipe operator, the action pattern, and brent prefers pest

The hosts introduce the podcast, emphasizing that while there is no real urgency, they will discuss pressing topics in PHP. The conversation starts with PHP generics, exploring their current state in PHP 8.6, the ongoing RFC, and the importance of static analysis tools like PHPStan and Psalm. They highlight that PHP generics are about enhancing static analysis rather than runtime type checking, and discuss the proposed syntax for generics, comparing it to how Python implements generics. The benefits of generics for static analysis, code inference, and ecosystem adoption are emphasized.

The discussion explains that PHP currently relies heavily on annotations for generics, with tools like PHPStan and Psalm interpreting them, and that the new RFC aims to bring native generics support without runtime overhead. They compare PHP's approach to languages like Python and TypeScript, describing how this could benefit frameworks like Laravel and WordPress by integrating generics seamlessly. The speakers advocate for this RFC as a crucial step toward making PHP's type system more powerful and integrated, stressing that failure of this RFC might delay generics in PHP indefinitely.

A comparison of static analysis tools—PHPStan, Psalm, Mago, and PHPStorm—is discussed, pointing out inconsistencies and gaps due to lack of a single specification for generics in PHP. Mago is highlighted as an emerging, fast, Rust-based static analyzer that is gaining popularity. The benefits of advanced tooling, including types of analysis (mutation, browser testing, parallel testing), are discussed, along with future developments expected in PHP testing frameworks like Pest.

The hosts focus on the rising importance of security within the PHP ecosystem, especially regarding composer and package security. They discuss recent improvements such as package release cooldowns, malware detection via Akito, and better package verification, including two-factor authentication visibility. The conversation underlines the critical need for multi-factor confirmation before package distribution, suggesting a future security model that involves package authors receiving release confirmation prompts. The PHP Foundation’s new security initiative and the importance of layered security measures are emphasized.

Brent shares his motivations for developing the Action Pattern, motivated by a real-world CRM project and inspired by functional programming ideas. The pattern involves small, invocable classes (actions) that encapsulate individual business logic steps, making code highly testable, composable, and explicit without side effects. Both Brent and the host discuss how the pattern helps maintain and understand complex applications compared to event-driven approaches, which tend to become difficult to maintain over time.

The conversation shifts to testing tools, with a focus on Tempest PHP, which integrates with Mago for code quality and whether to use Pest or PHPUnit for testing. The hosts discuss the power of browser testing in Pest PHP, utilizing real browsers like Chrome, and the exciting upcoming features in future versions of Pest, promising state-of-the-art testing capabilities. They highlight how these tools enable comprehensive end-to-end testing experiences that closely mimic production environments.

Brent talks about PHP Verse, an upcoming online conference showcasing the PHP community's diversity with speakers from Laravel, WordPress, Drupal, and Symphony. The event aims to demonstrate PHP's vibrant ecosystem and will be live streamed on YouTube, with fun activities like Lego elephant giveaways. The hosts conclude by inviting listeners to participate and share feedback on the podcast format, expressing enthusiasm for future episodes.