July 6th 2026 sarb open source static analysis
SARB (Static Analysis Results Baseliner) is an open source tool that lets you introduce static analysis tools, such as PHPStan and Psalm, to an existing codebase without fixing every pre-existing issue first. SARB records the issues that already exist in a baseline. On subsequent runs it strips the baselined issues out of the results, so only issues introduced since the baseline are reported. Your build fails on new issues, while the legacy ones can be fixed gradually over time.
Run an advanced static analysis tool against a large or legacy project for the first time and it will probably report hundreds, if not thousands, of issues. It's rarely realistic to fix them all before continuing feature development, so teams are left with an unpleasant choice: a huge up-front clean-up, or no static analysis at all.
Baselining removes that choice. Fix the most critical issues, baseline the rest, and from that point on hold all new code to the higher standard.
Install SARB with composer:
composer require --dev dave-liddament/sarb
SARB requires PHP >= 8.0 to run. The project being analysed does not need to run PHP 8.0, or even be a PHP project at all.
Because SARB uses git to track code between commits, the project being analysed must be in a git repository.
Make sure all your code is committed first; SARB records the git commit the baseline was created at.
Assuming you're using Psalm, pipe its JSON output into SARB's create command:
vendor/bin/psalm --output-format=json | vendor/bin/sarb create --input-format="psalm-json" psalm.baseline
This writes the baseline to psalm.baseline. Check this file in to your repository.
As you work on the code, run the static analyser again and use SARB's remove command to strip out the baselined issues:
vendor/bin/psalm --output-format=json | vendor/bin/sarb remove psalm.baseline
Only the issues introduced since the baseline are reported. Add this to your CI pipeline so the build fails on new issues only.
The same pattern works for PHPStan:
vendor/bin/phpstan analyse --error-format=json | vendor/bin/sarb create --input-format="phpstan-json" phpstan.baseline
vendor/bin/phpstan analyse --error-format=json | vendor/bin/sarb remove phpstan.baseline
Out of the box SARB supports:
Run vendor/bin/sarb list-static-analysis-tools for the full list of supported input formats.
If your tool isn't listed there are several ways to add support, and because SARB works on the tool's output it can baseline results for any language, not just PHP.
Both PHPStan and Psalm now ship their own baseline functionality, and for many projects that's a fine choice.
SARB works slightly differently: it uses git history to track lines of code between commits.
That means SARB still recognises a baselined issue after the file containing it has been renamed or moved (using git mv), where other approaches would report it as a new issue.
It also gives you one consistent baselining workflow across every tool in your CI pipeline, rather than one mechanism per tool.
Find out more on the SARB project page or in the README.