Phan/phan configuration for Symfony5 project - php

Question

I'm new at static analysis and I'm trying to use phan/phan on my current project.
My phan/config.php is as follow.
<?php
/**
* This configuration will be read and overlaid on top of the
* default configuration. Command-line arguments will be applied
* after this file is read.
*/
return [
// Supported values: `'5.6'`, `'7.0'`, `'7.1'`, `'7.2'`, `'7.3'`,
// `'7.4'`, `null`.
// If this is set to `null`,
// then Phan assumes the PHP version which is closest to the minor version
// of the php executable used to execute Phan.
//
// Note that the **only** effect of choosing `'5.6'` is to infer
// that functions removed in php 7.0 exist.
// (See `backward_compatibility_checks` for additional options)
// TODO: Set this.
'target_php_version' => null,
// A list of directories that should be parsed for class and
// method information. After excluding the directories
// defined in exclude_analysis_directory_list, the remaining
// files will be statically analyzed for errors.
//
// Thus, both first-party and third-party code being used by
// your application should be included in this list.
'directory_list' => [
'src',
'vendor/symfony/console',
],
// A regex used to match every file name that you want to
// exclude from parsing. Actual value will exclude every
// "test", "tests", "Test" and "Tests" folders found in
// "vendor/" directory.
'exclude_file_regex' => '#^vendor/.*/(tests?|Tests?)/#',
// A directory list that defines files that will be excluded
// from static analysis, but whose class and method
// information should be included.
//
// Generally, you'll want to include the directories for
// third-party code (such as "vendor/") in this list.
//
// n.b.: If you'd like to parse but not analyze 3rd
// party code, directories containing that code
// should be added to both the `directory_list`
// and `exclude_analysis_directory_list` arrays.
'exclude_analysis_directory_list' => [
'vendor/'
],
];
?>
My problem is that I have a lot of "false positive" errors like this :
src\Controller\UserController.php:6 PhanUnreferencedUseNormal Possibly zero references to use statement for classlike/namespace Route (\Symfony\Component\Routing\Annotation\Route)
src\Controller\UserController.php:7 PhanUnreferencedUseNormal Possibly zero references to use statement for classlike/namespace UserPasswordEncoderInterface (\Symfony\Component\Security\Core\Encoder\UserPasswordEncoderInterface)
src\Controller\UserController.php:8 PhanUnreferencedUseNormal Possibly zero references to use statement for classlike/namespace ContainerBagInterface (\Symfony\Component\DependencyInjection\ParameterBag\ContainerBagInterface)
src\Controller\UserController.php:9 PhanUnreferencedUseNormal Possibly zero references to use statement for classlike/namespace Security (\Sensio\Bundle\FrameworkExtraBundle\Configuration\Security)
It seems that phan can't detect Symfony vendors and I'm wondering how to correct it ?
I'm using php 7.4 with a Symfony 5 project

Answer 1

Looks like it's known issue:
https://github.com/phan/phan/issues/1757
In this Github issue, they advise using Phan Extension: https://github.com/Drenso/PhanExtensions#annotationsymfonyannotationplugin
Or try using PHPStan or Psalm.

Answer 2

I found it, the problem was on the following lines :
'directory_list' => [
'src',
'vendor/symfony/console',
],
This was taken directly from Phan example configuration, but since only the folder 'vendor/symfony/console' is included in directory_list, Phan has no way to know other Symfony components.
I've replaced this with :
'directory_list' => [
'src',
'vendor',
],
By including the entire vendor directory, it is parsed and Phan know every vendor object used in src.
As mentionned by Leprechaun, I've encoutered another problem with annotation not being correctly parsed by phan, and had to include the following plugin
'plugins' => [
'vendor/drenso/phan-extensions/Plugin/Annotation/SymfonyAnnotationPlugin.php'
],
Now it works.