codeql.yml

name: CodeQL

# SAST coverage for the Python workflow code under databricks/workflows/
# and the Docusaurus TypeScript under website/. Per Isaac v2 Recommendation
# Med #6.
#
# SQL is not a supported CodeQL language; the SQL security lint in ci.yml
# covers the dynamic-SQL patterns we care about.
#
# ⚠ Currently MANUAL-ONLY: code scanning SARIF upload requires GitHub
# Advanced Security (GHAS) on private repos. This repo doesn't have GHAS
# enabled, so the upload step 403s ("Resource not accessible by
# integration") and the workflow fails on every scheduled run. Until
# GHAS is enabled — or the repo is made public — `pull_request`, `push`,
# and `schedule` triggers are intentionally removed.
#
# To run it ad-hoc: Actions → CodeQL → "Run workflow".
# To re-enable scheduled scans: restore the triggers below the
# workflow_dispatch entry.

on:
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: codeql-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on:
      group: databricks-solutions-protected-runner-group
      labels: linux-ubuntu-latest
    permissions:
      contents: read
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        language: [python, javascript-typescript]
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
        with:
          persist-credentials: false

      - name: Initialize CodeQL
        uses: github/codeql-action/init@fee9466b8957867761f2d78f922ab084e3e2dd17  # v3
        with:
          languages: ${{ matrix.language }}
          queries: security-and-quality

      - name: Perform CodeQL analysis
        uses: github/codeql-action/analyze@fee9466b8957867761f2d78f922ab084e3e2dd17  # v3
        with:
          category: '/language:${{ matrix.language }}'