ci(static-code-analysis): Refactor pull request Psalm jobs into a matrix

Signed-off-by: Josh <josh.t.richards@gmail.com>

.github/workflows/static-code-analysis.yml

@@ -9,6 +9,8 @@ on:
       - main
       - master
       - stable*
+    # Push runs are intentionally kept because the security analysis job
+    # below also runs on push; the other analysis jobs are PR-only.
     paths:
       - '.github/workflows/static-code-analysis.yml'
       - '**.php'
@@ -46,10 +48,28 @@ jobs:
               - '**.php'
 
   static-code-analysis:
+    name: ${{ matrix.name }}
     runs-on: ubuntu-latest
 
     needs: changes
-    if: ${{ needs.changes.outputs.src != 'false' && github.event_name != 'push' && github.repository_owner != 'nextcloud-gmbh' }}
+    if: ${{ needs.changes.outputs.src != 'false' && github.event_name == 'pull_request' && github.repository_owner != 'nextcloud-gmbh' }}
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: Psalm
+            command: composer run psalm -- --threads=1 --monochrome --no-progress --output-format=github --update-baseline
+            check_baseline_diff: true
+          - name: Psalm OCP
+            command: composer run psalm:ocp -- --threads=1 --monochrome --no-progress --output-format=github --update-baseline
+            check_baseline_diff: true
+          - name: Psalm NCU
+            command: composer run psalm:ncu -- --threads=1 --monochrome --no-progress --output-format=github
+            check_baseline_diff: false
+          - name: Psalm strict
+            command: composer run psalm:strict -- --threads=1 --monochrome --no-progress --output-format=github
+            check_baseline_diff: false
 
     steps:
       - name: Checkout
@@ -68,14 +88,25 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Get Composer cache directory
+        id: composer-cache
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache Composer dependencies
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: ${{ steps.composer-cache.outputs.dir }}
+          key: ${{ runner.os }}-php-8.2-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-php-8.2-composer-
+
       - name: Composer install
         run: composer i
 
-      - name: Psalm
-        run: composer run psalm -- --threads=1 --monochrome --no-progress --output-format=github --update-baseline
+      - name: Run analysis
+        run: ${{ matrix.command }}
 
       - name: Show potential changes in Psalm baseline
-        if: always()
+        if: ${{ always() && matrix.check_baseline_diff }}
         run: git diff --exit-code -- . ':!lib/composer'
 
   static-code-analysis-security:
@@ -102,6 +133,17 @@ jobs:
           extensions: ctype,curl,dom,fileinfo,ftp,gd,imagick,intl,json,ldap,mbstring,openssl,pdo_sqlite,posix,sqlite,xml,zip
           coverage: none
 
+      - name: Get Composer cache directory
+        id: composer-cache-security
+        run: echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
+
+      - name: Cache Composer dependencies
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        with:
+          path: ${{ steps.composer-cache-security.outputs.dir }}
+          key: ${{ runner.os }}-php-8.2-composer-${{ hashFiles('**/composer.lock') }}
+          restore-keys: ${{ runner.os }}-php-8.2-composer-
+
       - name: Composer install
         run: composer i
 
@@ -118,101 +160,11 @@ jobs:
         with:
           sarif_file: results.sarif
 
-  static-code-analysis-ocp:
-    runs-on: ubuntu-latest
-
-    needs: changes
-    if: ${{ needs.changes.outputs.src != 'false' && github.event_name != 'push' && github.repository_owner != 'nextcloud-gmbh' }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-        with:
-          persist-credentials: false
-          submodules: true
-
-      - name: Set up php
-        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 #v2.36.0
-        timeout-minutes: 5
-        with:
-          php-version: '8.2'
-          extensions: ctype,curl,dom,fileinfo,gd,imagick,intl,json,mbstring,openssl,pdo_sqlite,posix,sqlite,xml,zip
-          coverage: none
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Composer install
-        run: composer i
-
-      - name: Psalm
-        run: composer run psalm:ocp -- --threads=1 --monochrome --no-progress --output-format=github --update-baseline
-
-      - name: Show potential changes in Psalm baseline
-        if: always()
-        run: git diff --exit-code -- . ':!lib/composer'
-
-  static-code-analysis-ncu:
-    runs-on: ubuntu-latest
-
-    needs: changes
-    if: ${{ needs.changes.outputs.src != 'false' && github.event_name != 'push' && github.repository_owner != 'nextcloud-gmbh' }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-        with:
-          persist-credentials: false
-          submodules: true
-
-      - name: Set up php
-        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 #v2.36.0
-        timeout-minutes: 5
-        with:
-          php-version: '8.2'
-          extensions: ctype,curl,dom,fileinfo,gd,imagick,intl,json,mbstring,openssl,pdo_sqlite,posix,sqlite,xml,zip
-          coverage: none
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Composer install
-        run: composer i
-
-      - name: Psalm
-        run: composer run psalm:ncu -- --threads=1 --monochrome --no-progress --output-format=github
-
-  static-code-analysis-strict:
-    runs-on: ubuntu-latest
-
-    needs: changes
-    if: ${{ needs.changes.outputs.src != 'false' && github.event_name != 'push' && github.repository_owner != 'nextcloud-gmbh' }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-        with:
-          persist-credentials: false
-          submodules: true
-
-      - name: Set up php
-        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 #v2.36.0
-        with:
-          php-version: '8.2'
-          extensions: ctype,curl,dom,fileinfo,gd,imagick,intl,json,mbstring,openssl,pdo_sqlite,posix,sqlite,xml,zip
-          coverage: none
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Composer install
-        run: composer i
-
-      - name: Psalm
-        run: composer run psalm:strict -- --threads=1 --monochrome --no-progress --output-format=github
-
   summary:
     permissions:
       contents: none
     runs-on: ubuntu-latest-low
-    needs: [changes, static-code-analysis, static-code-analysis-security, static-code-analysis-ocp, static-code-analysis-ncu, static-code-analysis-strict]
+    needs: [changes, static-code-analysis, static-code-analysis-security]
 
     if: always()
 
@@ -223,12 +175,8 @@ jobs:
         run: |
           if ${{ needs.changes.outputs.src != 'false' && (
             needs.static-code-analysis-security.result != 'success' ||
-            (github.event_name != 'push' && (
-              needs.static-code-analysis.result != 'success' ||
-              needs.static-code-analysis-ocp.result != 'success' ||
-              needs.static-code-analysis-ncu.result != 'success' ||
-              needs.static-code-analysis-strict.result != 'success'
-            ))
+            (github.event_name == 'pull_request' &&
+              needs.static-code-analysis.result != 'success')
           ) }}; then
             exit 1
           fi