Using phive to install PHP tools

Modern PHP development generally means using a suite of tools to perform code formatting and static analysis. For a long time, I have been using composer to install theses developement tools. While using composer works great, when you’re working on multiple projects it results in duplicate copies of frequently used tools. This takes up additional disk space, and uses additional network to re-download tools as I work across multiple branches requiring different tool versions. I’ve always considered this an unavoidable cost.

A few other CakePHP contributors have been using phive to manage and install these tools instead of composer. I had tried phive in the past, but stopped using it as I found synchronizing the versions for each tool with what was in my composer.json tedious and I didn’t want to put in the effort to make the workflow better as my composer based workflow as ‘good enough’.

Recently Kevin Pfiefer updated CakePHP to use phive alongside composer to manage static analysis tools. This is a great solution that I think more projects and teams could benefit from. I like it so much, that it will be I configure these tools going forward. Kevin’s solution was great because it included shims for the composer based workflow I’m used to, and can be easily adapted to other toolchains.commands to install and run static analysis tools.

Initial Setup

The only drawback of using phive to manage tools is the one time setup to get phive installed. I’ve annotated the installation
steps to make it clearer what each step is for:

Show Plain Text
  1. # Fetch the phive.phar file
  2. wget -O phive.phar ""
  4. # Download the signature for the phive.phar file
  5. wget -O phive.phar.asc ""
  7. # Add the phive signing key to gpg.
  8. gpg --keyserver hkps:// --recv-keys 0x6AF725270AB81E04D79442549D8A98B29B2D5D79
  10. # Verify that the phive.phar file matches the checksum and key we added.
  11. gpg --verify phive.phar.asc phive.phar
  13. # Remove the checksum
  14. rm phive.phar.asc
  16. # Make phive.phar executable and move it into place.
  17. chmod +x phive.phar
  18. mv phive.phar /usr/local/bin/phive

Before I could use phive to install any packages, I needed to install gnupg as my system didn’t already have it installed.

Project setup

With phive installed, we’re ready to add the necessary configuration files to install the specific versions of the tools we want. First, add .phive/phars.xml. For CakePHP, ours looks like:

Show Plain Text
  1. <?xml version="1.0" encoding="UTF-8"?>
  2. <phive xmlns="">
  3.   <phar name="phpstan" version="1.9.12" installed="1.9.12" location="./tools/phpstan" copy="false"/>
  4.   <phar name="psalm" version="4.30.0" installed="4.30.0" location="./tools/psalm" copy="false"/>
  5. </phive>

With this file in place we can run phive install. The first time you run phive install it will ask you to accept the signing keys for each project. Once phive install completes successfully you should have a tools directory with links to the required tools. Next we need to update our composer wrapper scripts to look like:

Show Plain Text
  1. {
  2.     "scripts": {
  3.         "phpstan": "tools/phpstan analyse",
  4.         "psalm": "tools/psalm --show-info=false",
  5.         "stan": [
  6.             "@phpstan",
  7.             "@psalm"
  8.         ],
  9.         "stan-tests": "phpstan.phar analyze -c tests/phpstan.neon",
  10.         "stan-baseline": "phpstan.phar --generate-baseline",
  11.         "stan-setup": "phive install",
  12.     }
  13. }

Now when we run composer stan-setup phive will download the required tools if they haven’t been installed yet, and then set the symlinks for the project. One aspect of this I really like is that we can use the same commands, configuration and tooling in local development and in CI. When we change branches, we can re-run composer stan-setup and get the correct versions of our tools. You should now be at a point where you are using phive to manage your PHP tools and share installed tools across each project that needs them.

That’s all there is to getting started with phive. Now you can keep your composer dependency list a bit smaller and save yourself some space, time and network when updating your projects or switching between branches and projects as your favorite tools are likely already installed.


There are no comments, be the first!

Have your say: