Adding Psalm PHP scanning to Starter Workflows

code-scanning/properties/psalm.properties.json

@@ -0,0 +1,10 @@
+{
+    "name": "Psalm Security Scan",
+    "creator": "psalm",
+    "description": "Psalm is a static analysis tool for finding errors in PHP applications",
+    "iconName": "mobsf",
+    "categories": [
+        "Code Scanning", 
+        "PHP"
+    ]
+}

code-scanning/psalm.yml

@@ -0,0 +1,30 @@
+# This workflow uses actions that are not certified by GitHub.
+# They are provided by a third-party and are governed by
+# separate terms of service, privacy policy, and support
+# documentation.
+
+name: Psalm Security Scan
+
+on:
+  push:
+    branches: [ $default-branch, $protected-branches ]
+  pull_request:
+    branches: [ $default-branch ]  
+  schedule:
+    - cron: $cron-weekly
+
+jobs:
+  php-security:
+    runs-on: ubuntu-latest
+    
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v2
+
+      - name: Psalm Security Scan
+        uses: psalm/psalm-github-security-scan@f3e6fd9432bc3e44aec078572677ce9d2ef9c287
+                    
+      - name: Upload Security Analysis results to GitHub
+        uses: github/codeql-action/upload-sarif@v1
+        with:
+          sarif_file: results.sarif