Update php-psalm.yml

Comment out the SARIF report check and upload steps in the workflow.

.github/workflows/php-psalm.yml

@@ -54,25 +54,25 @@ jobs:
       - name: Run Psalm (type analysis, report only)
         run: vendor/bin/psalm --output-format=github --report=psalm.sarif.json || true
 
-      # Psalm only writes the SARIF file when it runs far enough to produce a report.
-      # If it crashed early (e.g. bad config), skip the upload rather than pushing a
-      # blank SARIF, which would clear existing Code Scanning alerts.
-      - name: Check for SARIF report
-        id: sarif
-        if: ${{ !cancelled() }}
-        run: |
-          if [ -f psalm.sarif.json ]; then
-            echo "exists=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "exists=false" >> "$GITHUB_OUTPUT"
-            echo "::warning::Psalm did not produce psalm.sarif.json; skipping Code Scanning upload."
-          fi
+      # # Psalm only writes the SARIF file when it runs far enough to produce a report.
+      # # If it crashed early (e.g. bad config), skip the upload rather than pushing a
+      # # blank SARIF, which would clear existing Code Scanning alerts.
+      # - name: Check for SARIF report
+      #   id: sarif
+      #   if: ${{ !cancelled() }}
+      #   run: |
+      #     if [ -f psalm.sarif.json ]; then
+      #       echo "exists=true" >> "$GITHUB_OUTPUT"
+      #     else
+      #       echo "exists=false" >> "$GITHUB_OUTPUT"
+      #       echo "::warning::Psalm did not produce psalm.sarif.json; skipping Code Scanning upload."
+      #     fi
 
-      # Surface findings as Code Scanning alerts on the PR (Security tab). Runs even
-      # when the Psalm step failed, but only when a real SARIF file was produced.
-      - name: Upload SARIF to Code Scanning
-        if: ${{ !cancelled() && steps.sarif.outputs.exists == 'true' }}
-        uses: github/codeql-action/upload-sarif@v4
-        with:
-          sarif_file: psalm.sarif.json
-          category: psalm
+      # # Surface findings as Code Scanning alerts on the PR (Security tab). Runs even
+      # # when the Psalm step failed, but only when a real SARIF file was produced.
+      # - name: Upload SARIF to Code Scanning
+      #   if: ${{ !cancelled() && steps.sarif.outputs.exists == 'true' }}
+      #   uses: github/codeql-action/upload-sarif@v4
+      #   with:
+      #     sarif_file: psalm.sarif.json
+      #     category: psalm