Work down the Mago lint and analyzer baselines (354 findings)

[simon-mundy]

Summary

Tracks working down the mago baselines added in #11: 123 linter findings in lint-baseline.toml, 231 analyzer findings in analyzer-baseline.toml. New findings in new code already fail, so this is about ratcheting the recorded ones back to zero.

Per batch: fix a group, regenerate with mago lint --baseline lint-baseline.toml --generate-baseline or the analyze equivalent, check the count dropped and nothing new appeared, open a PR. The groups are independent.

Distribution

Four files hold 60% of the total, so the analyzer groups are better done per file than per rule.

• src/Metadata/Source.php — 99
• src/Connection.php — 51
• src/Pdo/Connection.php — 39
• src/Statement.php — 18
• src/Driver.php — 13
• src/AdapterPlatform.php — 12

Linter, 123

• Test conventions, 45, test-only — assertion-style 30, prefer-test-attribute 13, strict-assertions 2, across six test files. Mostly mago lint --fix --potentially-unsafe, though the #[Test] method renames want reading.
• no-isset 13 — src/Pdo/Connection.php 7, src/Metadata/Source.php 5, src/Statement.php 1. Semantic where absent and null differ.
• literal-named-argument 14 — 12 in src, 2 in tests, three files.
• tagged-todo 10 — nine files, needs (@user) or (#issue).
• Remainder 41 — no-else-clause 7, string-style 5, no-multi-assignments 4, cyclomatic-complexity 3, halstead 3, no-empty 3, kan-defect 2, no-literal-password 2, no-dead-store 2, no-literal-namespace-string 2, prefer-arrow-function 2, six singletons. The two no-literal-password are both in src/ConfigProvider.php and look like default config keys. cyclomatic-complexity, halstead and kan-defect sit in the same files as the analyzer work and should follow it.

Analyzer, 231

• src/Metadata/Source.php 99 — all 28 invalid-array-access, 23 of the 25 possibly-undefined-string-array-index, all 7 reference-constraint-violation, all 4 too-many-arguments, 5 unhandled-thrown-type. Untyped array plumbing over information_schema; wants array shapes or DTOs for the metadata rows.
• unhandled-thrown-type 25 — src/Connection.php 6, src/Metadata/Source.php 5, src/Container/PdoDriverInterfaceFactory.php 4, src/Container/DriverInterfaceFactory.php 3, src/Pdo/Connection.php 3, src/Container/PdoConnectionInterfaceFactory.php 2, src/Driver.php 2. @throws under check-throws. A driver-level exception that belongs in the shared unchecked-exceptions allowlist is a phpdb-qa-tools PR, not a local fix.
• Mixed and imprecise typing 51 — imprecise-type 16 over thirteen files, mixed-argument 14, mixed-assignment 12, mixed-array-assignment 7, mixed-return-statement 4, mixed-property-type-coercion 1. Largely covered by the Source.php work.
• Nullability and invalid values 32 — possibly-null-argument 9, possibly-invalid-argument 7, invalid-property-assignment-value 4, possibly-null-operand 3, invalid-argument 3, invalid-return-statement 3, possibly-null-array-access 2, possible-method-access-on-null 2, possibly-false-argument 2, nullable-return-statement 1. Defects rather than missing annotations, for the most part.
• Class and property contracts 27 — uninitialized-property 9 (5 src, 4 test), unused-parameter 9, class-must-be-final 7, missing-constructor 1, missing-override-attribute 1. enforce-class-finality with require-api-or-internal means AdapterPlatform, Connection, Metadata\Source, Pdo\Connection, Pdo\Driver, Result and Statement each have to be final, abstract or @api. For a 0.x driver that is a policy call to settle across the driver packages, not here.
• Redundancy and impossible conditions 14 — redundant-condition 4, docblock-type-mismatch 3, less-specific-argument 3, impossible-condition 2, impossible-type-comparison 2, invalid-type-cast 2, singletons. The impossible-condition, impossible-type-comparison and non-existent-method entries look like bugs or dead code.

Order

1. Test conventions.
2. The impossible and non-existent entries.
3. Nullability.
4. src/Metadata/Source.php, which covers much of the typing, no-isset and complexity work.
5. unhandled-thrown-type.
6. class-must-be-final, after the finality decision.
7. The complexity rules.

Related

#10, #11. #12 touches src/Result.php, which also carries a class-must-be-final entry.