psalm.yml

name: "Psalm Security Scan"

on:
  pull_request:
  push:
    branches-ignore:
      - "dependabot/**"

jobs:
  psalm:
    name: "Psalm"

    runs-on: ${{ matrix.operating-system }}

    strategy:
      matrix:
        dependencies:
          - "locked"
        php-version:
          - "8.1"
        operating-system:
          - "ubuntu-latest"

    steps:
      - name: "Checkout"
        uses: "actions/checkout@v4"

      - name: "Composer install"
        uses: ./.github/actions/composer
        with:
          php-version: '${{ matrix.php-version }}'
          dependencies: '${{ matrix.dependencies }}'
          extensions: json, mbstring

      - name: "Psalm Security Scan"
        run: .Build/bin/psalm --output-format=github --taint-analysis --report=results.sarif

      - name: "Upload Security Analysis results to GitHub"
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif