chore: SEC25-115 Update CodeQL workflow to use official Psalm GitHub Action template (#27)

Author: Glenn-Ewing

.github/workflows/codeql.yml

@@ -1,3 +1,4 @@
+# Run Psalm Shared Workflow
 name: "CodeQL"
 
 on:
@@ -6,58 +7,54 @@ on:
   pull_request:
     branches: [ "master" ]
   schedule:
-    - cron: '30 12 * * 1'
+    - cron: '30 12 1,15 * *'
 
 jobs:
-  analyze:
+  quality:
     strategy:
       matrix:
         php-versions: [ '8.0', '8.1', '8.2', '8.3' ]
-    name: Analyze PHP ${{ matrix.php-versions }}
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    name: Psalm Code Quality on PHP ${{ matrix.php-versions }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
         name: Check Out Code
 
-      - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+      - name: Psalm
+        uses: docker://ghcr.io/psalm/psalm-github-actions
         with:
-          php-version: ${{ matrix.php-versions }}
-          tools: pecl
-          extensions: ""
-
-      - name: Validate composer.json and composer.lock
-        run: composer validate
-
-      - name: Setup Composer Access
-        run: composer config -g github-oauth.github.com ${{ secrets.GITHUB_TOKEN }}
-        
-      - name: Cache Composer packages
-        id: composer-cache
-        uses: actions/cache@v4
+          php_version: ${{ matrix.php-versions }}
+          report_file: psalm-report.sarif
+        continue-on-error: true
+
+      - name: Upload SARIF report
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: psalm-report.sarif
+  
+  security:
+    strategy:
+      matrix:
+        php-versions: [ '8.0', '8.1', '8.2', '8.3' ]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    name: Psalm Code Security on PHP ${{ matrix.php-versions }}
+
+    steps:
+      - uses: actions/checkout@v6
+        name: Check Out Code
+
+      - name: Psalm
+        uses: docker://ghcr.io/psalm/psalm-github-actions
         with:
-          path: vendor
-          key: ${{ runner.os }}-composer-${{ matrix.php-versions }}-${{ hashFiles('**/composer.lock') }}
-          restore-keys: |
-            ${{ runner.os }}-composer-${{ matrix.php-versions }}-
-            ${{ runner.os }}-composer-
-
-      - name: Install dependencies
-        if: steps.composer-cache.outputs.cache-hit != 'true'
-        run: composer install --prefer-dist --no-progress --optimize-autoloader
-
-      - name: Perform CodeQL Analysis using Psalm
-        run: |
-          if [ "${{ github.event_name }}" == "pull_request" ]; then
-             vendor/bin/psalm --diff --output-format=sarif --report=psalm-report.sarif || true
-          else
-             vendor/bin/psalm --no-diff --output-format=sarif --report=psalm-report.sarif || true
-          fi
+          php_version: ${{ matrix.php-versions }}
+          security_analysis: true
+          report_file: psalm-report.sarif
         continue-on-error: true
 
       - name: Upload SARIF report
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: psalm-report.sarif