Enhancement: Run vimeo/psalm on GitHub Actions

.editorconfig

@@ -5,6 +5,10 @@ charset = utf-8
 insert_final_newline = true
 trim_trailing_whitespace = true
 
+[*.xml]
+indent_size = 2
+indent_style = space
+
 [*.yaml]
 indent_size = 2
 indent_style = space

.github/CONTRIBUTING.md

@@ -4,7 +4,7 @@ Anybody who programs in PHP can be a contributing member of the community that
 develops and deploys www.php.net; the task of deploying the www.php.net website is a never-ending one.
 
 You don't need any special access to download, debug and begin submitting
-code, tests or documentation. 
+code, tests or documentation.
 
 ## Index
 
@@ -74,6 +74,19 @@ about what you're working on, you can contact us via the
   ```
 
   to automatically fix coding standard issues.
+- Run
+
+  ```shell
+  make static-code-analysis
+  ```
+
+  to run a static code analysis or, if applicable, run
+
+  ```shell
+  make static-code-analysis-baseline
+  ```
+
+  to regenerate the baseline.
 - Review the change once more just before submitting it.
 
 ## What happens after submitting contribution?
@@ -93,7 +106,7 @@ bumping. Before doing this think about these questions:
 
 ## What happens when your contribution is applied?
 
-Your name will likely be included in the Git commit log. 
+Your name will likely be included in the Git commit log.
 
 ## Git commit rules
 
@@ -133,7 +146,20 @@ Having said that, here are the organizational rules:
    ```
    make coding-standards
    ```
+6. Run
+
+  ```shell
+  make static-code-analysis
+  ```
+
+  to run a static code analysis or, if applicable, run
+
+  ```shell
+  make static-code-analysis-baseline
+  ```
+
+  to regenerate the baseline.
 
-6. Use reasonable commit messages.
+7. Use reasonable commit messages.
 
 Thank you for contributing to https://www.php.net!

.github/workflows/integrate.yaml

@@ -27,7 +27,7 @@ jobs:
         uses: "shivammathur/setup-php@v2"
         with:
           coverage: "none"
-          extensions: "none, json, mbstring, tokenizer"
+          extensions: "none, dom, json, mbstring, simplexml, tokenizer"
           php-version: "${{ matrix.php-version }}"
 
       - name: "Set up problem matchers for PHP"
@@ -54,6 +54,52 @@ jobs:
         env:
           PHP_CS_FIXER_IGNORE_ENV: "1"
 
+  static-code-analysis:
+    name: "Static Code Analysis"
+
+    runs-on: "ubuntu-latest"
+
+    strategy:
+      matrix:
+        php-version:
+          - "8.2"
+
+        dependencies:
+          - "locked"
+
+    steps:
+      - name: "Checkout"
+        uses: "actions/checkout@v3"
+
+      - name: "Set up PHP"
+        uses: "shivammathur/setup-php@v2"
+        with:
+          coverage: "none"
+          extensions: "none, dom, json, mbstring, pcntl, posix, simplexml, tokenizer"
+          php-version: "${{ matrix.php-version }}"
+
+      - name: "Set up problem matchers for PHP"
+        run: "echo \"::add-matcher::${{ runner.tool_cache }}/php.json\""
+
+      - name: "Determine composer cache directory"
+        run: "echo \"COMPOSER_CACHE_DIR=$(composer config cache-dir)\" >> $GITHUB_ENV"
+
+      - name: "Cache dependencies installed with composer"
+        uses: "actions/cache@v3"
+        with:
+          path: "${{ env.COMPOSER_CACHE_DIR }}"
+          key: "php-${{ matrix.php-version }}-composer-${{ hashFiles('composer.lock') }}"
+          restore-keys: "php-${{ matrix.php-version }}-composer-"
+
+      - name: "Install dependencies with composer"
+        run: "composer install --ansi --no-interaction --no-progress"
+
+      - name: "Create cache directory for vimeo/psalm"
+        run: "mkdir -p .build/psalm"
+
+      - name: "Run vimeo/psalm"
+        run: "vendor/bin/psalm --config=psalm.xml --output-format=github --shepherd --show-info=false --stats --threads=4"
+
   tests:
     name: "Tests"
 

.gitignore

@@ -1,3 +1,4 @@
+/.build/
 /vendor/
 
 backend/mirror.gif

Makefile

@@ -10,6 +10,18 @@ coding-standards: vendor ## Fixes code style issues with friendsofphp/php-cs-fix
 tests: ## Runs tests
 	php tests/run-tests.php -j3 -q
 
+.PHONY: static-code-analysis
+static-code-analysis: vendor ## Runs a static code analysis with vimeo/psalm
+	mkdir -p .build/psalm/
+	vendor/bin/psalm --config=psalm.xml --clear-cache
+	vendor/bin/psalm --config=psalm.xml --show-info=true --stats --threads=4
+
+.PHONY: static-code-analysis-baseline
+static-code-analysis-baseline: vendor ## Generates a baseline for static code analysis with vimeo/psalm
+	mkdir -p .build/psalm/
+	vendor/bin/psalm --config=psalm.xml --clear-cache
+	vendor/bin/psalm --config=psalm.xml --set-baseline=psalm-baseline.xml
+
 vendor: composer.json composer.lock
 	composer validate --strict
 	composer install --no-interaction --no-progress

composer.json

@@ -11,7 +11,8 @@
         "php": "~8.2.0"
     },
     "require-dev": {
-        "friendsofphp/php-cs-fixer": "^3.40.2"
+        "friendsofphp/php-cs-fixer": "^3.40.2",
+        "vimeo/psalm": "^5.17.0"
     },
     "autoload": {
         "psr-4": {