psalm-matrix.yml installs OCP compat-matrix version into root vendor, not vendor-bin/nextcloud-ocp

[moodyjmz]

TL;DR: Since #128 moved nextcloud/ocp:dev-master into vendor-bin/nextcloud-ocp/composer.json (bamarni composer-bin-plugin pattern), .github/workflows/psalm-matrix.yml still installs its OCP compat-matrix version into the root vendor tree, while the bamarni-managed dev-master install lives in vendor-bin/nextcloud-ocp/vendor. psalm.xml's extraFiles now lists both locations, so psalm scans two copies of nextcloud/ocp. Harmless today because the matrix currently resolves to a single entry (dev-master, since appinfo/info.xml pins one Nextcloud version), so both copies are identical — but once the matrix widens to more than one OCP version, which copy psalm actually analyzes becomes unspecified.

Detail

• psalm-matrix.yml "Install dependencies" step:

  composer remove nextcloud/ocp --dev --no-scripts
  composer i
  composer require --dev 'nextcloud/ocp:${{ matrix.ocp-version }}' --ignore-platform-reqs --with-dependencies
  

  This installs the matrix version at root. The composer remove step is now a no-op (nextcloud/ocp is not required in your composer.json and has not been removed — confirmed non-fatal in CI logs), since root no longer requires it after chore: update psalm and fix config #128.
• Meanwhile composer install (invoked via the bamarni plugin, or directly) installs dev-master under vendor-bin/nextcloud-ocp/vendor, and psalm.xml's extraFiles now includes both:

  <extraFiles>
      <directory name="vendor"/>
      <directory name="vendor-bin/nextcloud-ocp/vendor"/>
  </extraFiles>

• Suggested fix: switch the psalm-matrix install step to use the bamarni-aware command consistently, e.g. composer bin nextcloud-ocp require --dev 'nextcloud/ocp:${{ matrix.ocp-version }}' ..., and drop the now-dead composer remove nextcloud/ocp --dev --no-scripts lines in both psalm-matrix.yml and lint-php-cs.yml.
• Found during review of chore: update psalm and fix config #128/feat: add navigation actions for office #130 dependency chain.

[susnux]

CI handles it like this:

office/.github/workflows/update-nextcloud-ocp-matrix.yml

Lines 62 to 80 in 4f8e414

	- name: Check composer bin for nextcloud/ocp exists
	id: check_composer_bin
	uses: andstor/file-existence-action@558493d6c74bf472d87c84eab196434afc2fa029 # v3.1.0
	with:
	files: vendor-bin/nextcloud-ocp/composer.json
	- name: Composer update nextcloud/ocp
	id: update_branch
	env:
	USE_COMPOSER_BIN: ${{ steps.check_composer_bin.outputs.files_exists }}
	BRANCH_NAME: ${{ steps.versions.outputs.branches-min }}
	run: |
	COMPOSER_CMD='composer'
	if [[ "$USE_COMPOSER_BIN" == 'true' ]]; then
	COMPOSER_CMD='composer bin nextcloud-ocp'
	fi
	echo $COMPOSER_CMD require --dev nextcloud/ocp:dev-$BRANCH_NAME
	$COMPOSER_CMD require --dev nextcloud/ocp:dev-$BRANCH_NAME

So I guess this is not a problem or if it is then this needs to be fixed in the https://github.com/nextcloud/.github/ templates