feat(phpstan): added php stan

TODO.md

@@ -18,8 +18,7 @@ Order matters — later steps assume earlier ones are done.
         `config/packages/idci_graphql_client.yaml`. Run `composer update` and
         commit the regenerated `composer.lock`.
 
-- [x] **Dedupe `baseUrl` normalization.** `GitLabProvider.php` (lines 41,
-  53) and `GiteaProvider.php` (lines 42, 54) each call
+- [x] **Dedupe `baseUrl` normalization.** `GitLabProvider.php` (lines 41, 53) and `GiteaProvider.php` (lines 42, 54) each call
       `rtrim($this->baseUrl..., '/')` twice — once in `ping()`, once in
       `fetch()`. Compute it once as a `private readonly string $baseUrl` in
       the constructor instead.
@@ -101,8 +100,8 @@ Order matters — later steps assume earlier ones are done.
       the configured retention window (a unix timestamp cutoff); no-ops if
       retention is unset/0.
 - [x] Constructor takes `?int $retentionDays` bound from new env var
-  `CONTRIBUTIONS_RETENTION_DAYS` (empty/default = keep forever). *(constructor
-  param wired; the env binding itself is step 6's job.)*
+      `CONTRIBUTIONS_RETENTION_DAYS` (empty/default = keep forever). _(constructor
+      param wired; the env binding itself is step 6's job.)_
 - [x] Tests: `tests/Unit/Service/ContributionStoreTest.php` — store &
       retrieve, upsert overwrites existing date, `sinceDays` filtering,
       `prune()` no-ops when retention unset, `prune()` deletes rows older
@@ -147,8 +146,8 @@ PHP `max_execution_time` fatal can't be caught by `try/catch` at all, so
   ```yaml
   App\Service\ContributionStore:
     arguments:
-          $dbPath: '%kernel.project_dir%/var/data/contributions.db'
-          $retentionDays: '%env(int:CONTRIBUTIONS_RETENTION_DAYS)%'
+      $dbPath: "%kernel.project_dir%/var/data/contributions.db"
+      $retentionDays: "%env(int:CONTRIBUTIONS_RETENTION_DAYS)%"
   ```
   Add `env(CONTRIBUTIONS_RETENTION_DAYS): ''` to `parameters:` (empty →
   casts to `0` → `prune()`'s existing `retentionDays === 0` check already
@@ -226,11 +225,12 @@ incremental `latestDate()` window entirely for the providers/range given.
 
 ## 10. PHPStan
 
-- [ ] `composer require --dev phpstan/phpstan` (plain PHPStan — no
+- [x] `composer require --dev phpstan/phpstan` (plain PHPStan — no
       Symfony extension needed for this app's size).
-- [ ] Add `phpstan.neon`: `paths: [src, tests]`, `level: 8`.
+- [x] Add `phpstan.neon`: `paths: [src, tests]`, `level: 8`.
 - [ ] Add composer script `"phpstan": "phpstan analyse"`.
-- [ ] Fix whatever level-8 flags on first run.
+- [ ] Update README.md docs with new command and php stan static lintin.
+- [ ] Document in PHP-Stan-Errors.md whatever level-8 flags on first run.
 
 ## 11. `CLAUDE.md` update
 

composer.json

@@ -25,6 +25,7 @@
         }
     },
     "require-dev": {
+        "phpstan/phpstan": "^2.2",
         "phpunit/phpunit": "^11.5",
         "symfony/phpunit-bridge": "^7.4"
     },

composer.lock

@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "9e1d0aa40107f1c8cda205ed101547fe",
+    "content-hash": "70c6dbef453ea64accc644e5e5f9d7fc",
     "packages": [
         {
             "name": "monolog/monolog",
@@ -3320,6 +3320,70 @@
             },
             "time": "2022-02-21T01:04:05+00:00"
         },
+        {
+            "name": "phpstan/phpstan",
+            "version": "2.2.5",
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/phpstan/phpstan/zipball/909c1e5fef7989ac0d0c1c5c42e32a5c4f6198a0",
+                "reference": "909c1e5fef7989ac0d0c1c5c42e32a5c4f6198a0",
+                "shasum": ""
+            },
+            "require": {
+                "php": "^7.4|^8.0"
+            },
+            "conflict": {
+                "phpstan/phpstan-shim": "*"
+            },
+            "bin": [
+                "phpstan",
+                "phpstan.phar"
+            ],
+            "type": "library",
+            "autoload": {
+                "files": [
+                    "bootstrap.php"
+                ]
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Ondřej Mirtes"
+                },
+                {
+                    "name": "Markus Staab"
+                },
+                {
+                    "name": "Vincent Langlet"
+                }
+            ],
+            "description": "PHPStan - PHP Static Analysis Tool",
+            "keywords": [
+                "dev",
+                "static analysis"
+            ],
+            "support": {
+                "docs": "https://phpstan.org/user-guide/getting-started",
+                "forum": "https://github.com/phpstan/phpstan/discussions",
+                "issues": "https://github.com/phpstan/phpstan/issues",
+                "security": "https://github.com/phpstan/phpstan/security/policy",
+                "source": "https://github.com/phpstan/phpstan-src"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/ondrejmirtes",
+                    "type": "github"
+                },
+                {
+                    "url": "https://github.com/phpstan",
+                    "type": "github"
+                }
+            ],
+            "time": "2026-07-05T06:31:06+00:00"
+        },
         {
             "name": "phpunit/php-code-coverage",
             "version": "11.0.12",

phpstan.neon

@@ -0,0 +1,5 @@
+parameters:
+    level: 8
+    paths: 
+        - src
+        - tests