Bug report

It seems that directories specified in excludes_analyse are not only excluded from analysis, but also from scanning (but only using scanDirectories, not scanFiles). I'm not sure if this is intentional, but it is certainly not documented (only the docs for paths seem to document the excludes_analyse directive, making me think it should only apply there).

Code snippet that reproduces the problem

Here's a dummy example, that has a similar structure as my original codebase but also shows the problem. It is intentionally minimal and probably does not make sense by itself, but shows the problem concisely.

$ tree
.
├── phpstan.neon
└── src
    ├── mine.php
    └── thirdparty
        └── thirdparty.php

2 directories, 3 files
$ cat phpstan.neon 
parameters:
 level: 5
 paths:
  - src
 excludes_analyse:
  - src/thirdparty
 scanDirectories:
  - src/thirdparty
$ cat src/mine.php 
<?php
some_function();
$ cat src/thirdparty/thirdparty.php 
<?php
function some_function() {
}
$ php phpstan.phar analyse 
Note: Using configuration file /home/matthijs/test/phpstan.neon.
 1/1 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓] 100%

 ------ -------------------------------------------------------------------- 
  Line   mine.php                                                            
 ------ -------------------------------------------------------------------- 
  2      Function some_function not found.                                   
         💡 Learn more at https://phpstan.org/user-guide/discovering-symbols  
 ------ -------------------------------------------------------------------- 
                                                                                                                        
 [ERROR] Found 1 error                                                                                                  
                                                                                                                        

Expected output

The function is defined in a scanned directory, but an error is shown as if the directory is not scanned. If I remove the excludes_analyse from the config, the error disappears, but now src/thirdparty is also scanned.

I suspect that phpstan is intended for a directory layout where your own code and third party code are separated on the top level, but this is not how our codebase is structured. As a workaround, I'm now omitting exclude_analyse and instead specifying all subdirectories of src that contain my own code explicitly, which works, but isn't ideal to maintain (easy to forget a new directory, silently not analysing it).

Note that this problem does not occur with scanFiles. If I change the
config file to the following, no errors are reported (i.e.
thirdparty.php is scanned as expected):

$ cat phpstan.neon
parameters:
 level: 5
 paths:
  - src
 excludes_analyse:
  - src/thirdparty/thirdparty.php
 scanFiles:
  - src/thirdparty/thirdparty.php

Fixes

I can think of two fixes:

1. Do not apply excludes_analyse to scanDirectories
2. Let any files / directories specified with scanDirectories and scanFiles be excluded from analysis automatically. This would remove the need for specifying third party stuff double (in excludes_analyse and scanDirectories / scanFiles). AFAIU, the there would never be a reason to specify a file as both analyzed and scanned (analyzing it implies its already scanned, so if you specify it needs to be (only) scanned, you can exclude it from analysis safely).

I guess both of these could even be applied, since the former makes things more like (IMHO) expected and documented, and the latter makes it easier to configure phpstan.