Stop CI disruption from phpstan/phpstan and mglaman/phpstan-drupal: pin versions + introduce nightly `phpstan-is-up-to-date` CI job to nudge updates
>>> [!note] Migrated issue
<!-- Drupal.org comment -->
<!-- Migrated from issue #3587543. -->
Reported by: [wim leers](https://www.drupal.org/user/99777)
Related to !1005 !1004
>>>
<h3 id="overview">Overview</h3>
<p>Disruptions in the past ~30 days</p>
<ul>
<li>(yesterday) <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/canvas/-/work_items/3587395" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/canvas/-/work_items/3587395</a></span></li>
<li>Apr 16 <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/canvas/-/work_items/3585319" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/canvas/-/work_items/3585319</a></span></li>
<li>Apr 15 <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/canvas/-/work_items/3585060" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/canvas/-/work_items/3585060</a></span></li>
<li>Apr 13 <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/canvas/-/work_items/3584531" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/canvas/-/work_items/3584531</a></span></li>
<li>Mar 31 <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/canvas/-/work_items/3582335" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/canvas/-/work_items/3582335</a></span></li>
<li>Mar 24 <span class="drupalorg-gitlab-issue-link drupalorg-gitlab-link-wrapper"><a href="https://git.drupalcode.org/project/canvas/-/work_items/3581290" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/canvas/-/work_items/3581290</a></span></li>
</ul>
<p>This previously used to be rare. Each of these bring nice refinements, but they're not worth the disruption for in-progress MRs.</p>
<h3 id="proposed-resolution">Proposed resolution</h3>
<p>Adopt a strategy similar to <span class="drupalorg-gitlab-issue-link project-issue-status-info project-issue-status-7"><a href="https://www.drupal.org/project/experience_builder/issues/3462742" title="Status: Closed (fixed)">#3462742: CI: use a snapshot of core's phpcs rules as changes in Drupal core will break MRs with limited benefit to module development</a></span>.</p>
<p>Differences:</p>
<ul>
<li>Core has a far lower PHPStan level, so doesn't run into this. ⇒ the "keep in sync with core" approach of #3462742 does not apply here</li>
<li>So instead, pin a specific PHPStan version, and have a GitLab CI job fail <em>that is allowed to fail</em> (to avoid disruption) inform us we should update it.</li>
</ul>
<h3 id="ui-changes">User interface changes</h3>
<p>None.</p>
<p>CI impact: see screenshots in <a href="https://git.drupalcode.org/project/canvas/-/merge_requests/1004">https://git.drupalcode.org/project/canvas/-/merge_requests/1004</a></p>
> Related issue: [Issue #3587395](https://www.drupal.org/node/3587395)
> Related issue: [Issue #3462742](https://www.drupal.org/node/3462742)
issue