From 3d09e8d91244091e9bf43da85740026c8d475e1f Mon Sep 17 00:00:00 2001
From: provokateurin <kate@provokateurin.de>
Date: Wed, 19 Nov 2025 10:31:23 +0100
Subject: [PATCH] feat(psalm): Add strict config for new code

Signed-off-by: provokateurin <kate@provokateurin.de>
---
 .github/workflows/static-code-analysis.yml | 27 +++++++++++++++++++
 composer.json                              |  1 +
 psalm-strict.xml                           | 30 ++++++++++++++++++++++
 3 files changed, 58 insertions(+)
 create mode 100644 psalm-strict.xml

diff --git a/.github/workflows/static-code-analysis.yml b/.github/workflows/static-code-analysis.yml
index 1ee13554b6f..8b020442292 100644
--- a/.github/workflows/static-code-analysis.yml
+++ b/.github/workflows/static-code-analysis.yml
@@ -149,3 +149,30 @@ jobs:
 
       - name: Psalm
         run: composer run psalm:ncu -- --threads=1 --monochrome --no-progress --output-format=github
+
+  static-code-analysis-strict:
+    runs-on: ubuntu-latest
+
+    if: ${{ github.event_name != 'push' && github.repository_owner != 'nextcloud-gmbh' }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8
+        with:
+          persist-credentials: false
+          submodules: true
+
+      - name: Set up php
+        uses: shivammathur/setup-php@ec406be512d7077f68eed36e63f4d91bc006edc4 #v2.35.4
+        with:
+          php-version: '8.2'
+          extensions: ctype,curl,dom,fileinfo,gd,imagick,intl,json,mbstring,openssl,pdo_sqlite,posix,sqlite,xml,zip
+          coverage: none
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Composer install
+        run: composer i
+
+      - name: Psalm
+        run: composer run psalm:strict -- --threads=1 --monochrome --no-progress --output-format=github
diff --git a/composer.json b/composer.json
index cf8f07cfe44..bbff74be00f 100644
--- a/composer.json
+++ b/composer.json
@@ -70,6 +70,7 @@
 		"psalm": "psalm --no-cache --threads=$(nproc)",
 		"psalm:ocp": "psalm --no-cache --threads=$(nproc) -c psalm-ocp.xml",
 		"psalm:ncu": "psalm --no-cache --threads=$(nproc) -c psalm-ncu.xml",
+		"psalm:strict": "psalm --no-cache --threads=$(nproc) -c psalm-strict.xml",
 		"psalm:security": "psalm --no-cache --threads=$(nproc) --taint-analysis --use-baseline=build/psalm-baseline-security.xml",
 		"psalm:fix": "psalm --alter --issues=InvalidReturnType,InvalidNullableReturnType,MissingParamType,InvalidFalsableReturnType",
 		"psalm:update-baseline": "psalm --no-cache --threads=$(nproc) --update-baseline",
diff --git a/psalm-strict.xml b/psalm-strict.xml
new file mode 100644
index 00000000000..a11451d3b95
--- /dev/null
+++ b/psalm-strict.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0"?>
+<!--
+ - SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
+ - SPDX-License-Identifier: AGPL-3.0-or-later
+-->
+<psalm
+	errorLevel="1"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xmlns="https://getpsalm.org/schema/config"
+	xsi:schemaLocation="https://getpsalm.org/schema/config"
+	resolveFromConfigFile="false"
+	findUnusedBaselineEntry="true"
+	findUnusedCode="false"
+	findUnusedPsalmSuppress="true"
+	findUnusedVariablesAndParams="true"
+	phpVersion="8.2"
+>
+	<projectFiles>
+		<ignoreFiles>
+			<directory name="apps/**/composer"/>
+			<directory name="apps/**/tests"/>
+			<directory name="lib/composer"/>
+			<directory name="lib/l10n"/>
+			<directory name="3rdparty"/>
+		</ignoreFiles>
+	</projectFiles>
+	<extraFiles>
+		<directory name="3rdparty"/>
+	</extraFiles>
+</psalm>