Add reusable PHPCS and AI-checklist workflows for plugin repos, PG-4897

[snake14]

Description

Extends the centralization started in #44 to the two remaining plugin workflows that are effectively identical across repositories:

• plugin-phpcs.yml — the per-plugin phpcs.yml copies differ only in the lowercased plugin name passed to composer init and in drifted PHP versions (7.4 vs 8.1 across repos today); both become inputs. The setup-php action is pinned by hash, matching Add a reusable PHPStan workflow and the canonical pre-push hook, PG-4897 #44.
• plugin-ai-checklist.yml — the per-plugin matomo-ai-checklist.yml is byte-identical in every repo that has one, and some repos simply lack it (ApiReference only gained it recently); a reusable workflow makes adoption a 7-line caller.

Caller shape, respectively:

name: PHPCS check
on: pull_request
jobs:
  phpcs:
    uses: matomo-org/github-action-tests/.github/workflows/plugin-phpcs.yml@main
    with:
      plugin-name: MyPlugin

name: AI Checklist
on:
  pull_request:
    types: [opened, synchronize, reopened, edited]
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true
jobs:
  AiChecklist:
    uses: matomo-org/github-action-tests/.github/workflows/plugin-ai-checklist.yml@main

Deliberately excluded: matomo-tests.yml. It is generated by core's ./console generate:test-action and genuinely varies per plugin (custom PHP version matrices, --setup-script, --has-submodules, --protect-artifacts, per-repo cron schedules). Its centralization path is evolving the generator to emit a thin caller of a reusable workflow, which is a core change and should be its own ticket.

README documentation for these two will follow in #44 or after it merges, to avoid conflicting edits to the same README section.

Ticket: PG-4897.

Checklist

• [✔] I have understood, reviewed, and tested all AI outputs before use
• [✔] All AI instructions respect security, IP, and privacy rules

Review

• Functional review done
• Potential edge cases thought about (behaviour of the code with strange input, with strange internal state or possible interactions with other Matomo subsystems)
• Usability review done (is anything maybe unclear or think about anything that would cause people to reach out to support)
• Security review done
• Wording review done
• Code review done
• Tests were added if useful/possible
• Reviewed for breaking changes
• Developer changelog updated if needed
• New documentation added or existing documentation updated

[lachiebol]

LGTM, do we have any plans to migrate our plugins over?

[lachiebol]

Is there a reason we use this d5f1 commit instead of main?

[lachiebol]

Oh I see in the readme

[snake14]

LGTM, do we have any plans to migrate our plugins over?

@lachiebol Yeah. I figured that I could have Claude open a bunch of PRs to migrate to shared workflows once these PRs are merged.

[snake14]

Apologies @lachiebol . I realised that the workflow didn't have a name. Could you please give it another approval?

[snake14]

Closing as this will go into a new repo.