Add PHPStan to QA checks

.gitattributes

@@ -9,6 +9,7 @@
 /.codecov.yml       export-ignore
 /.phpcs.xml.dist    export-ignore
 /CODE_OF_CONDUCT.md export-ignore
+/phpstan.neon.dist  export-ignore
 /phpunit.xml.dist   export-ignore
 /.github            export-ignore
 /Tests              export-ignore

.github/workflows/basic-qa.yml

@@ -160,3 +160,31 @@ jobs:
       - name: Fail the build on fixer conflicts and other errors
         if: ${{ steps.phpcbf.outputs.EXITCODE != 0 && steps.phpcbf.outputs.EXITCODE != 1 }}
         run: exit ${{ steps.phpcbf.outputs.EXITCODE }}
+
+  phpstan:
+    name: "PHPStan"
+
+    runs-on: "ubuntu-latest"
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Install PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: '7.4'
+          coverage: none
+          tools: phpstan
+
+      # Install dependencies and handle caching in one go.
+      # Dependencies need to be installed to make sure the PHPCS and PHPUnit classes are recognized.
+      # @link https://github.com/marketplace/actions/install-composer-dependencies
+      - name: Install Composer dependencies
+        uses: "ramsey/composer-install@v2"
+        with:
+          # Bust the cache at least once a month - output format: YYYY-MM.
+          custom-cache-suffix: $(date -u "+%Y-%m")
+
+      - name: Run PHPStan
+        run: phpstan analyse

.gitignore

@@ -4,3 +4,4 @@ build/
 phpunit.xml
 phpcs.xml
 .phpcs.xml
+phpstan.neon

phpstan.neon.dist

@@ -0,0 +1,26 @@
+parameters:
+    #phpVersion: 50400 # Needs to be 70100 or higher... sigh...
+    level: 5
+    paths:
+        - WordPress
+    bootstrapFiles:
+        - Tests/bootstrap.php
+    treatPhpDocTypesAsCertain: false
+
+    ignoreErrors:
+        # Level 0
+        - '#^Result of method \S+ \(void\) is used\.$#'
+
+        # Level 4
+        - '#^Property \S+::\$\S+ \([^)]+\) in isset\(\) is not nullable\.$#'
+        -
+            count: 1
+            message: '#^Result of && is always true\.$#'
+            path: WordPress/Sniffs/Security/EscapeOutputSniff.php
+        -
+            count: 1
+            message: '#^Strict comparison using === between true and false will always evaluate to false\.$#'
+            path: WordPress/Sniffs/Utils/I18nTextDomainFixerSniff.php
+
+        # Level 5
+        - '#^Parameter \#3 \$value of method \S+File::recordMetric\(\) expects string, \(?(float|int|bool)(\|(float|int|bool))*\)? given\.$#'