Enhancement: Run static code analysis with vimeo/psalm

.gitattributes

@@ -5,3 +5,5 @@
 /.php-cs-fixer.php  export-ignore
 /composer.lock      export-ignore
 /Makefile           export-ignore
+/psalm-baseline.xml export-ignore
+/psalm.xml          export-ignore

.github/CONTRIBUTING.md

@@ -18,6 +18,30 @@ make coding-standards
 
 to automatically fix coding standard violations.
 
+## Static Code Analysis
+
+We are using [`vimeo/psalm`](https://github.com/vimeo/psalm) to statically analyze the code.
+
+Run
+
+```sh
+make static-code-analysis
+```
+
+to run a static code analysis.
+
+We are also using the baseline feature of [`vimeo/psalm`](https://psalm.dev/docs/running_psalm/dealing_with_code_issues/#using-a-baseline-file).
+
+Run
+
+```sh
+make static-code-analysis-baseline
+```
+
+to regenerate the baseline in [`../psalm-baseline.xml`](../psalm-baseline.xml).
+
+:exclamation: Ideally, the baseline should shrink over time.
+
 ## Extra lazy?
 
 Run
@@ -26,7 +50,8 @@ Run
 make
 ```
 
-to automatically enforce coding standards!
+to automatically enforce coding standards and run a static code analysis!
+
 
 ## Help
 

.github/workflows/integrate.yaml

@@ -65,3 +65,54 @@ jobs:
 
       - name: "Run friendsofphp/php-cs-fixer"
         run: "vendor/bin/php-cs-fixer fix --ansi --config=.php-cs-fixer.php --diff --dry-run --verbose"
+
+  static-code-analysis:
+    name: "Static Code Analysis"
+
+    runs-on: "ubuntu-latest"
+
+    strategy:
+      matrix:
+        php-version:
+          - "8.1"
+
+        dependencies:
+          - "locked"
+
+    steps:
+      - name: "Checkout"
+        uses: "actions/checkout@v3.5.2"
+
+      - name: "Set up PHP"
+        uses: "shivammathur/setup-php@2.25.1"
+        with:
+          coverage: "none"
+          extensions: "none, ctype, curl, dom, json, mbstring, opcache, pcntl, phar, posix, simplexml, tokenizer, xml, xmlwriter"
+          php-version: "${{ matrix.php-version }}"
+
+      - name: "Set up problem matchers for PHP"
+        run: "echo \"::add-matcher::${{ runner.tool_cache }}/php.json\""
+
+      - name: "Validate composer.json and composer.lock"
+        run: "composer validate --ansi --strict"
+
+      - name: "Determine composer cache directory"
+        uses: "ergebnis/.github/actions/composer/determine-cache-directory@1.8.0"
+
+      - name: "Cache dependencies installed with composer"
+        uses: "actions/cache@v3.3.1"
+        with:
+          path: "${{ env.COMPOSER_CACHE_DIR }}"
+          key: "php-${{ matrix.php-version }}-composer-${{ matrix.dependencies }}-${{ hashFiles('composer.lock') }}"
+          restore-keys: "php-${{ matrix.php-version }}-composer-${{ matrix.dependencies }}-"
+
+      - name: "Install ${{ matrix.dependencies }} dependencies with composer"
+        uses: "ergebnis/.github/actions/composer/install@1.8.0"
+        with:
+          dependencies: "${{ matrix.dependencies }}"
+
+      - name: "Create cache directory for vimeo/psalm"
+        run: "mkdir -p .build/psalm"
+
+      - name: "Run vimeo/psalm"
+        run: "vendor/bin/psalm --config=psalm.xml --output-format=github --shepherd --show-info=false --stats --threads=4"

Makefile

@@ -1,5 +1,5 @@
 .PHONY: it
-it: coding-standards ## Runs the coding-standards target
+it: coding-standards static-code-analysis ## Runs the coding-standards and static-code-analysis targets
 
 .PHONY: coding-standards
 coding-standards: vendor ## Fixes code style issues with friendsofphp/php-cs-fixer
@@ -10,6 +10,18 @@ coding-standards: vendor ## Fixes code style issues with friendsofphp/php-cs-fix
 help: ## Displays this list of targets with descriptions
 	@grep -E '^[a-zA-Z0-9_-]+:.*?## .*$$' $(MAKEFILE_LIST) | sort | awk 'BEGIN {FS = ":.*?## "}; {printf "\033[32m%-30s\033[0m %s\n", $$1, $$2}'
 
+.PHONY: static-code-analysis
+static-code-analysis: vendor ## Runs a static code analysis with vimeo/psalm
+	mkdir -p .build/psalm/
+	vendor/bin/psalm --config=psalm.xml --clear-cache
+	vendor/bin/psalm --config=psalm.xml --show-info=false --stats --threads=4
+
+.PHONY: static-code-analysis-baseline
+static-code-analysis-baseline: vendor ## Generates a baseline for static code analysis with vimeo/psalm
+	mkdir -p .build/psalm/
+	vendor/bin/psalm --config=psalm.xml --clear-cache
+	vendor/bin/psalm --config=psalm.xml --set-baseline=psalm-baseline.xml
+
 vendor: composer.json composer.lock
 	composer validate --strict
 	composer install --no-interaction --no-progress

composer.json

@@ -21,7 +21,8 @@
     "php": "~8.0.0 || ~8.1.0 || ~8.2.0"
   },
   "require-dev": {
-    "ergebnis/php-cs-fixer-config": "^5.5.2"
+    "ergebnis/php-cs-fixer-config": "^5.5.2",
+    "vimeo/psalm": "^5.11.0"
   },
   "config": {
     "platform": {