DOCSEARCHbyAlgolia
Submit Docs

SymfonyInsight Documentation

website·Indexed 43 days ago

https://insight.symfony.com/docs

A static analysis tool for Symfony projects designed to automate risk detection and prevent critical problems. The documentation covers getting started for freelancers and teams, configuring the execution environment, managing private code and Composer dependencies, and setting up notifications via Slack, Microsoft Teams, HipChat, or custom WebHooks.

Tokens
10.2K
Snippets
36
Records
76
Agent score
65%

What's inside SymfonyInsight

  1. Overview of SymfonyInsight risk protection

    SymfonyInsight is a tool designed to protect development teams and projects from critical business and technical risks. It provides automated analysis to identify issues in the following areas:

    • Security: Detects vulnerabilities before they reach production.
    • Legal: Helps prevent GDPR complaints and Intellectual Property lawsuits.
    • Data: Assists in avoiding data leaks and ensuring data integrity.
    • Reliability: Helps avoid production downtimes and major bugs.
    • Productivity: Prevents productivity slowdowns and negative growth.
    • Reputation: Ensures technical issues do not negatively impact the brand.

  2. Understand how SymfonyInsight manages private code

    SymfonyInsight accesses source code for quality analysis using two primary methods:

    1. Pull Mode: SymfonyInsight automatically retrieves code from a Git repository hosted on an external service (e.g., GitHub), regardless of whether the repository is public or private.
    2. Push Mode: You set up a private Git repository directly on SymfonyInsight and explicitly push the code before each analysis.

    To ensure security and isolation, every project is analyzed on its own dedicated virtual machine, preventing filesystem access between different projects.

  4. View project quality statistics

    Project quality statistics provide a high-level overview of technical debt and issue distribution. Access these by clicking the View statistics button in the Statistics section of the project sidebar. The statistics view includes three primary graphs:

    1. Remediation cost and lines of code evolution: Shows the proportion of technical debt relative to the codebase size over time.
    2. Issue severity distribution: Breaks down issues by severity (critical, major, minor, info) to help prioritize debt reduction.
    3. Issue category distribution: Categorizes issues (e.g., security, architecture problems) to identify the types of technical debt accumulated.

  5. Analyze Symfony projects using dynamic and static analysis

    SymfonyInsight combines static code analysis with a state-of-the-art dynamic analysis engine. Unlike standard static analysis, the dynamic engine boots the application to learn how it actually works, providing higher accuracy and more detailed reports on potential issues.

  6. Integrate SymfonyInsight into a team workflow

    To effectively track the progress and quality of multiple projects as a team, follow these four steps:

    1. Add all projects: Ensure every project in your portfolio is added to SymfonyInsight to create a comprehensive quality overview.
    2. Enable automatic analysis: Configure SymfonyInsight to be notified by your code hosting platform whenever code changes occur. This ensures the quality overview is always up-to-date. For GitHub users, enabling Pull Request analysis is also recommended to provide quality feedback directly within GitHub.
    3. Set up notifications: Instead of manually checking the dashboard, configure alerts to be notified when quality issues arise. Supported channels include Email, Slack, HipChat, and custom Webhooks.
    4. Generate quality reports: Use the printable executive and full quality reports feature to communicate project progress to external stakeholders or clients.

  7. Understand the SymfonyInsight WebHook payload

    When a configured WebHook is triggered, SymfonyInsight sends a JSON payload via POST. The payload contains the following keys:

    • project: Basic information about the project (ID, name, URL, and API URL).
    • analysis: Key details about the analysis (number, name, URL, API URL, grade, and remediation cost).
    • status: The current status of the analysis. Possible values: pending, success, failure, analysis_error, or config_error.
    • status_text: A human-readable description of the status.
    POST /my-webhook-url HTTP/1.1

{
    "project": {
        "id": "45afb680-d4e6-4e66-93ea-bcfa79eb8a87",
        "name": "symfony",
        "url": "https://insight.symfony.com/projects/45afb680-d4e6-4e66-93ea-bcfa79eb8a87",
        "api_url": "https://insight.symfony.com/api/projects/45afb680-d4e6-4e66-93ea-bcfa79eb8a87"
    },
    "analysis": {
        "number": 10229,
        "name": "fabpot / symfony #10229",
        "url": "https://insight.symfony.com/projects/45afb680-d4e6-4e66-93ea-bcfa79eb8a87/analyses/10229",
        "api_url": "https://insight.symfony.com/api/projects/45afb680-d4e6-4e66-93ea-bcfa79eb8a87/analyses/10229",
        "grade": "bronze",
        "remediation_cost": 214.75
    },
    "status": "success",
    "status_text": "Code quality OK."
}

  8. Migrate to the next Symfony major version

    After fixing all detected deprecations, you can migrate to the next major version (e.g., from 6.4 to 7.0):

    1. Update composer.json by replacing references to the current minor version (e.g., 6.4.*) with the new major version (e.g., 7.0.*) for all symfony/* packages.
    2. Update the extra.symfony.require configuration key for Symfony Flex.
    3. Run composer update.

    Troubleshooting: If the composer update command fails, check the documentation of your third-party dependencies, as they may also need to be upgraded to support the new Symfony major version.

    composer update

  9. Upgrade to the latest Symfony minor version

    Minor version upgrades are safe and do not require code changes. To upgrade to the latest minor version (e.g., from 6.2 to 6.4):

    1. Update composer.json by replacing references to the old minor version (e.g., 6.2.*) with the new one (e.g., 6.4.*) for all symfony/* packages.
    2. Ensure the extra.symfony.require configuration key is updated for Symfony Flex.
    3. Run composer update.
    composer update

  10. Get started with SymfonyInsight as a freelancer

    To begin using SymfonyInsight as a freelancer, follow these two steps:

    1. Sign up: Create an account via SymfonyConnect. For freelancers, the Individual plan is recommended as it typically meets the needs of those not requiring collaboration features.
    2. Add a project: Grant SymfonyInsight access to your code. It supports code stored in GitHub, Bitbucket, GitLab, and custom Git repositories.

    When adding a project, you must specify the project type (e.g., Symfony application, PHP library, WordPress plugin). This ensures that only relevant metrics are run and reduces false positives.

  11. Create an incoming WebHook in Microsoft Teams

    To allow SymfonyInsight to send notifications, you must first create a WebHook in your Teams channel:

    1. Go to teams.microsoft.com.
    2. Click the ... button next to the desired channel.
    3. Select "Connectors".
    4. Choose a name and click "Create".
    5. Copy the generated WebHook URL (it will follow the pattern https://outlook.office.com/webhook/...).

  12. Enable natively supported PHP extensions in SymfonyInsight

    Some advanced analysis rules in SymfonyInsight require the application to run. If your project depends on PHP extensions, you must enable them manually via the project configuration.

    Steps to enable:

    1. Click the Edit project link at the top right of the project or analysis page.
    2. Use the php_ini configuration setting to list the required extensions.
    3. Click the Update button. Changes apply to the next analysis.

    Natively supported extensions include: apcu, bcmath, bz2, curl, gd, gettext, gmp, iconv, intl, mbstring, mcrypt, mysql, openssl, pcntl, pdo_mysql, pdo_pgsql, pgsql, readline, soap, xsl, zip, and zlib.

    php_ini: |
    extension=mcrypt.so
    extension=openssl.so