Psalm: switch from Phive to Composer

[jrfnl]

Psalm: switch from Phive to Composer

This switches the installation method for Psalm from Phive to Composer, while still using a Phar file for running Psalm.

Includes:

• Removing Psalm from the Phive configuration.
• Adding Psalm to the Composer configuration. Includes upgrading from version 3.11.2 to version 4.8.1.
• Adjusting the script used in the Makefile.
  👉 Please verify and test this as things work differently on different OS-es and this should work for you.
• Adjusting the GH Actions script to use the Composer installed version of Psalm.

Note: due to the committed composer.lock file, Psalm will not automatically upgrade when newer versions are available.

Refs:

• https://github.com/vimeo/psalm/releases
• https://github.com/psalm/phar/releases

Defensive coding fix

The $matches array returned by explode() can be an empty array. In that case, end() would return false, which due to the string cast would become an empty string.

Psalm flags the string cast though with:

ERROR: RedundantCast - src/Fqsen.php:66:21 - Redundant cast to string (see https://psalm.dev/262)
            $name = (string) end($matches);

... which in my opinion is incorrect.

I tried various options to get round this, but most ended up being flagged by Psalm again, even though IMO this flagging is incorrect.

Either way, the current change fixes the Psalm violation and does not trigger new violation flags.

[jaapio]

Thanks, I think the fix for psalm is ok. Since a cast from false to string is odd, anyway. I think that's the reason psalm is complaining about this.

Regarding the lock-file, we are using dependabot in all repo's. Having a locked version of psalm makes sense, because like you experienced, new versions might introduce new violations.

[jrfnl]

Regarding the lock-file, we are using dependabot in all repo's. Having a locked version of psalm makes sense, because like you experienced, new versions might introduce new violations.

Fair enough, though you can also manage that via the version constraint in composer.json, of course ;-)