PHPStan configuration for Drupal 7 – https://youtu.be/9HYwq5jq4Sk

phpstan.neon

parameters:
	level: 0
	excludePaths:
		- '*.api.php'
		- '*.database.php'
	scanFiles:
		- web/authorize.php
		- web/cron.php
		- web/index.php
		- web/update.php
		- web/xmlrpc.php
		# A quirk with functions that return values by reference &batch_get
		# and &views_get_page_view. The problem resolves if the file is specifically scanned.
		- web/includes/form.inc
		# - web/sites/all/modules/contrib/views/views.module
	scanDirectories:
		- web/includes
		- web/misc
		- web/modules
		- web/profiles
		- web/themes
		- web/sites/all
	fileExtensions:
		- module
		- theme
		- inc
		- install
		- profile
		- engine
		- test

Thanks for sharing this config file! Here are a few notes from a n00b:

• With recent versions of PHPStan, use excludePaths instead of excludes_analyse.
• To check what needs to be updated for PHP 8, add something like phpVersion: 80100.
• If the configuration file is in the root directory, make sure you run phpstan from there, or add the --configuration (short form -c) option. Look for "Note: Using configuration file ..." at the top of the command's output.

I ran into the last point when using DDev: by default, ddev ssh changes to the web/ directory.

References:

• https://www.php.net/supported-versions.php
• https://phpstan.org/config-reference#miscellaneous-parameters