Skip to the main content
{}

Open-source Laravel tool

Laravel Transaction Guard

Static analysis tool that checks Laravel code for side effects that can escape a database rollback.

View on GitHub(Opens in a new window)Discuss safe Laravel transactions

When should you use this tool?

Use this package during development, CI or an explicit deployment or maintenance scan to detect risky side effects inside DB::transaction(...) and manual transactions before a rollback can undo database changes while external actions have already happened.

Unsafe transaction boundaries become visible through static analysis, common after-commit patterns are recognized and existing projects can introduce stricter checks gradually with a baseline.

Who is this tool for? Laravel teams that use database transactions and want to keep jobs, events, mail, notifications, HTTP calls and other external side effects safely aligned with commits and validated across their delivery workflow.

Quickstart

Local installation

Use the repository as a starting point. Always verify your own project requirements and lockfiles before production use.

Choose one installation mode. These commands are alternatives, not consecutive steps.

Available after composer install --no-dev

composer require codegenie-be/laravel-transaction-guard

Development and CI only

composer require --dev codegenie-be/laravel-transaction-guard

Key capabilities

  • 01Analyzes both DB::transaction(...) and manual beginTransaction(), commit() and rollBack() flows
  • 02Detects risky jobs, events, mail, notifications, broadcasts, mutating HTTP calls, filesystem, cache, Redis, process and cross-connection database side effects
  • 03Recognizes common safe after-commit patterns, including afterCommit(), ShouldQueueAfterCommit, ShouldDispatchAfterCommit and DB::afterCommit(...) callbacks
  • 04Supports GitHub, JSON and SARIF output with a configurable fail-on threshold for CI and other automation
  • 05Supports baselines and targeted local suppressions for controlled adoption in existing projects
  • 06Can be run explicitly and read-only in local, testing, staging, production, CI and custom Laravel environments without package-specific .env variables
  • 07Performs static analysis only and does not change transactions or normal HTTP behavior through runtime hooks or monkey-patching

A rollback cannot undo external actions

Synthetic scenario: a transaction updates an order and makes an HTTP request, then fails. The database can roll back, but the external request is not undone. Transaction Guard statically analyses such patterns; it does not change transactions during an HTTP request.

bash
php artisan transaction:guard --format=json

Resolving a finding

  • Choose the development dependency or an installation that remains available after --no-dev. Do not execute both installation alternatives consecutively.
  • Schedule external actions after the relevant commit. The external action can still fail; recovery, status tracking and idempotency remain separate design tasks.
  • An after-commit pattern does not guarantee exactly one external processing. Test duplicate delivery and retries after failure.
  • The documented scanner does not open database connections or execute the analysed source. The host Laravel application must still be able to boot.
  • Static findings can miss context. Prefer a targeted, justified exception over ignoring every warning.
Read about external actions, retries and idempotency

Another useful Laravel resource

Laravel Livewire Multi-step Form

Open source

Open-source Composer package for Laravel 12/13 and Livewire 3.6+/4: a configurable multi-step form with validation, a review step and a controlled submission hook.

Laravel teams integrating multi-step forms without handing application persistence to a package.

View the toolGitHub(Opens in a new window)

Adapt a tool to your own Laravel project?

Codegenie can tailor the flow, styling, validation or deployment to your existing application.

Discuss your project