# Share a PHPStan Report — Level 9 Findings as a Link

Canonical: https://commareports.com/share-phpstan-report
Published: 2026-09-15

> PHPStan has no HTML formatter, but it writes JUnit and Checkstyle. Convert either, publish to Comma, and the static-analysis backlog becomes something a team can triage together.

# Share a PHPStan report

Raising a PHPStan level is a project, not a commit. Level 6 on a codebase that
has been at level 5 for two years produces a few hundred findings, most of
them one-line fixes, none of them assignable from a terminal dump.

PHPStan won't write HTML. It will write JUnit, and JUnit converts.

## JUnit → HTML

```bash
composer require --dev phpstan/phpstan
pip install junit2html

./vendor/bin/phpstan analyse --error-format=junit > phpstan.xml || true
junit2html phpstan.xml phpstan.html
```

## Or Checkstyle, if the pipeline already speaks it

```bash
./vendor/bin/phpstan analyse --error-format=checkstyle > phpstan-checkstyle.xml || true
```

Then feed it to whatever renders Checkstyle in your stack. Same destination,
one fewer new dependency — see [sharing a Checkstyle
report](/share-checkstyle-report).

Either way, `|| true` is load-bearing: `phpstan analyse` exits non-zero on any
finding, and the run with findings is the one worth publishing.

## Publish it

Drag `phpstan.html` into [the app](https://commareports.com/), or from CI:

```bash
curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html phpstan.html \
        --arg title "PHPStan L$LEVEL — $GITHUB_REF_NAME" '{title: $title, html: $html}')"
```

## Raising the level, visibly

Keep one report id per repo and PATCH it weekly. The revision history becomes
the record of a level bump: the run before, the runs in between, the run where
the count hit zero and the baseline got deleted.

- **Anchored threads** on a cluster of findings, so "these are all the same
  missing generic annotation on the repository interface" is written once,
  next to them. See [commenting on HTML](/comment-on-html).
- **A [routine](/features/routines/scheduled-html-reports)** re-running the
  analysis on a schedule so nobody has to remember.

## Limits

- **Entry HTML: 5 MB.** Assets: 25 MB per file, 250 MB and 500 files total.
  A first run at a higher level is the one that gets close — analyse one
  directory for the shareable view.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish a static analysis report →](https://commareports.com/)**

### Related

- [Share a Psalm report](/share-psalm-report) · [Share a PHPUnit report](/share-phpunit-report)
- [Share a Pest report](/share-pest-report) · [Share a Checkstyle report](/share-checkstyle-report)
- [Share a PMD report](/share-pmd-report) · [Publish from CI](/docs/ci)