No flags on bool arguments by ildyria · Pull Request #1 · LycheeOrg/phpstan-sensitive-parameter-values

ildyria · 2026-07-18T10:30:04Z

Summary by CodeRabbit

New Features
- Added sensitive-parameter propagation checks across function, method, constructor, and static calls.
- Added safeguards against storing sensitive values without secure wrapping.
- Added improved type inference for wrapped sensitive values.
Bug Fixes
- Boolean and boolean-style parameters are no longer incorrectly flagged as sensitive.
Documentation
- Updated project branding, requirements, usage guidance, and security badges.
Chores
- Improved automated testing, security scanning, release management, and development workflows.

ildyria · 2026-07-18T12:47:29Z

@coderabbitai review.

coderabbitai · 2026-07-18T12:47:44Z

@ildyria I’ll review the changes with the stated boolean-argument objective in mind.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai · 2026-07-18T12:47:49Z

Warning

Review limit reached

@ildyria, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 22 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 06ba22e8-ebd4-4530-b530-79b44fc880a6

📥 Commits

Reviewing files that changed from the base of the PR and between b640f71 and be3066d.

📒 Files selected for processing (18)

.github/workflows/ci.yml
.github/workflows/dependency-review.yml
README.md
composer.json
extension.neon
src/Rules/SensitiveParameterDetectorRule.php
src/Rules/SensitiveParameterPropagationRule.php
src/Rules/SensitiveParameterStorageRule.php
stubs/SensitiveParameterValue.stub
tests/Detector/BasicSensitiveParametersTest.php
tests/Detector/CustomKeywordsTest.php
tests/DetectorTestCase.php
tests/Fixtures/Propagation/PropagationCases.php
tests/Fixtures/Storage/StorageCases.php
tests/Propagation/SensitiveParameterPropagationTest.php
tests/PropagationTestCase.php
tests/StorageTestCase.php
tests/Unit/Rules/SensitiveParameterDetectorRuleTest.php

📝 Walkthrough

Walkthrough

Changes

Sensitive parameter analysis platform

Layer / File(s)	Summary
Project metadata and developer tooling `.github/CODEOWNERS`, `.github/FUNDING.yml`, `.github/dependabot.yml`, `.github/release.yml`, `LICENSE`, `Makefile`, `README.md`, `composer.json`	Repository metadata, package identity, documentation, dependency automation, release configuration, and development commands are added or updated.
CI and supply-chain workflows `.github/workflows/*`	CI matrices, permissions, concurrency, pinned actions, runner hardening, dependency review, and Scorecard reporting are configured.
Detector behavior and test organization `extension.neon`, `phpstan.neon`, `phpunit.xml`, `src/Rules/SensitiveParameterDetectorRule.php`, `tests/Detector/`, `tests/Fixtures/Detector/`	Boolean-like parameters are excluded from detector warnings, and dedicated tests cover detector behavior and fixtures.
Sensitive parameter propagation `src/Rules/SensitiveParameterPropagationRule.php`, `tests/Propagation`, `tests/Fixtures/Propagation/`	Call-site sensitivity is resolved across methods, constructors, static calls, and functions, with diagnostics for missing callee attributes.
Sensitive value storage protection `src/Rules/SensitiveParameterStorageRule.php`, `tests/Storage`, `tests/Fixtures/Storage/`	Direct and unwrapped sensitive-value property storage is detected, including promoted properties and `getValue()` assignments.
Typed SensitiveParameterValue support `stubs/SensitiveParameterValue.stub`, `tests/Types/`, `tests/Fixtures/Types/`	A generic stub preserves wrapped value types through `getValue()`, with type-inference coverage for several value shapes.

Estimated code review effort: 4 (Complex) | ~60 minutes

Poem

I’m a bunny with rules in my burrow tonight,
Wrapping secrets in type-safe delight.
Calls pass their warnings, storage stays bright,
CI guards the garden from morning till night,
And typed little carrots make analyses right.

🚥 Pre-merge checks | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 74.14% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 13

🧹 Nitpick comments (1)

tests/Fixtures/Detector/BasicSensitiveParameters.php (1)
12-13: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Correct the documentation comment.

The comment indicates this is a "Regular function (not class method)", but the code defines a public static function, which is a class method. Consider updating the comment, or if the intent was to test a standalone function, move it outside of the class block.
♻️ Proposed fix
-    // Regular function (not class method)
+    // Static class method
     public static function regularFunction(string $userSecret, string $credential): string

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 836f066e-7023-4cf2-b71f-198e12320309

📥 Commits

Reviewing files that changed from the base of the PR and between 2dbb5f5 and b640f71.

📒 Files selected for processing (40)

.github/CODEOWNERS
.github/FUNDING.yml
.github/dependabot.yml
.github/release.yml
.github/workflows/ci.yml
.github/workflows/dependency-review.yml
.github/workflows/scorecard.yml
LICENSE
Makefile
README.md
composer.json
extension.neon
phpstan.neon
phpunit.xml
src/Rules/SensitiveParameterDetectorRule.php
src/Rules/SensitiveParameterPropagationRule.php
src/Rules/SensitiveParameterStorageRule.php
stubs/SensitiveParameterValue.stub
tests/Detector/BasicSensitiveParametersTest.php
tests/Detector/BooleanCasesTest.php
tests/Detector/CustomKeywordsTest.php
tests/Detector/IgnoreCommentsTest.php
tests/DetectorTestCase.php
tests/Feature/BasicSensitiveParametersTest.php
tests/Feature/CustomKeywordsTest.php
tests/Fixtures/Detector/BasicSensitiveParameters.php
tests/Fixtures/Detector/BooleanCases.php
tests/Fixtures/Detector/CustomKeywords.php
tests/Fixtures/Detector/EdgeCases.php
tests/Fixtures/Detector/IgnoreComments.php
tests/Fixtures/Detector/ProtectedSensitiveParameters.php
tests/Fixtures/Propagation/PropagationCases.php
tests/Fixtures/Storage/StorageCases.php
tests/Fixtures/Types/SensitiveParameterValueTypes.php
tests/Pest.php
tests/Propagation/SensitiveParameterPropagationTest.php
tests/PropagationTestCase.php
tests/Storage/SensitiveParameterStorageTest.php
tests/StorageTestCase.php
tests/Types/SensitiveParameterValueTypesTest.php

💤 Files with no reviewable changes (2)

tests/Feature/BasicSensitiveParametersTest.php
tests/Feature/CustomKeywordsTest.php

ildyria added 6 commits July 18, 2026 12:29

First stab

b02bb06

fix

7de3622

avoid flagging on bools and is-prefixed

83bab81

Add two more rules

fdfb2a7

correct branch

b61aa7b

fix tests

b640f71

ildyria marked this pull request as ready for review July 18, 2026 12:47

coderabbitai Bot requested changes Jul 18, 2026

View reviewed changes

ildyria added 2 commits July 18, 2026 15:23

fix tests & comments & namespace

787dfda

readme

be3066d

coderabbitai Bot approved these changes Jul 18, 2026

View reviewed changes

ildyria merged commit 8d69830 into main Jul 18, 2026
12 checks passed

ildyria deleted the lychee-take-over branch July 18, 2026 13:26

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

No flags on bool arguments#1

No flags on bool arguments#1
ildyria merged 8 commits into
mainfrom
lychee-take-over

ildyria commented Jul 18, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

ildyria commented Jul 18, 2026

Uh oh!

coderabbitai Bot commented Jul 18, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 18, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

ildyria commented Jul 18, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

ildyria commented Jul 18, 2026

Uh oh!

coderabbitai Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ildyria commented Jul 18, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 18, 2026 •

edited

Loading

coderabbitai Bot commented Jul 18, 2026 •

edited

Loading