static-analysis.yml

name: Static Analysis
on:
    push:
        branches: [main]
        paths:
            - '.github/workflows/static-analysis.yml'
            - 'src/**'
            - 'psalm.xml'
            - 'psalm-baseline.xml'
    pull_request:
        branches: [main]
        paths:
            - '.github/workflows/static-analysis.yml'
            - 'src/**'
            - 'psalm.xml'
            - 'psalm-baseline.xml'

concurrency:
    group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
    cancel-in-progress: true

jobs:
    psalm:
        name: Psalm
        runs-on: ubuntu-latest
        permissions:
            security-events: write
            actions: read
            contents: read
        strategy:
            fail-fast: false
            matrix:
                php-version: ['8.2']
        steps:
            - uses: actions/checkout@v3
            - uses: shivammathur/setup-php@v2
              with:
                  php-version: '${{ matrix.php-version }}'
                  coverage: none
            - run: make composer-install phpunit-install psalm-install
            - run: php src/SonsOfPHP/Bard/bin/bard install -n -vvv
            - run: make psalm-github
            - name: Upload Security Analysis to Github
              if: github.ref == 'refs/heads/main'
              uses: github/codeql-action/upload-sarif@v2
              with:
                  sarif_file: results.sarif