security.yml

# Unless explicitly stated otherwise all files in this repository are licensed under
# the Apache 2.0 License.
#
# This product includes software developed at Datadog
# (https://www.datadoghq.com/) Copyright 2025-Present Datadog, Inc.

name: Security

on:
  pull_request:
  push:
    branches:
      - main
      - "feature/**"
  schedule:
    - cron: "23 4 * * 1"

permissions:
  contents: read

concurrency:
  group: ci-${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  # Mirror the CI workflow's docs-only gate so markdown-only PR updates do not
  # rerun repository security scans while still producing completed checks.
  changes:
    timeout-minutes: 5
    runs-on: ubuntu-latest
    outputs:
      docs_only: ${{ steps.classify.outputs.docs_only }}
      run_full_ci: ${{ steps.classify.outputs.run_full_ci }}
    steps:
      - name: Checkout
        if: ${{ github.event_name != 'schedule' }}
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          fetch-depth: 0

      - name: Classify changed files
        id: classify
        shell: bash
        env:
          EVENT_NAME: ${{ github.event_name }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          PUSH_BEFORE_SHA: ${{ github.event.before }}
          PUSH_AFTER_SHA: ${{ github.sha }}
        run: |
          set -euo pipefail

          if [[ "${EVENT_NAME}" == "schedule" ]]; then
            {
              echo "docs_only=false"
              echo "run_full_ci=true"
            } >> "${GITHUB_OUTPUT}"
            exit 0
          fi

          case "${EVENT_NAME}" in
            pull_request)
              base_sha="${PR_BASE_SHA}"
              head_sha="${PR_HEAD_SHA}"
              ;;
            push)
              base_sha="${PUSH_BEFORE_SHA}"
              head_sha="${PUSH_AFTER_SHA}"
              ;;
            *)
              base_sha=""
              head_sha=""
              ;;
          esac

          while IFS= read -r line; do
            echo "${line}" >> "${GITHUB_OUTPUT}"
          done < <(./tools/dev/classify_ci_changes.sh "${base_sha}" "${head_sha}")

  dependency-review:
    needs: changes
    if: github.event_name == 'pull_request' && needs.changes.outputs.run_full_ci == 'true'
    timeout-minutes: 10
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: read
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Dependency review
        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          fail-on-severity: high

  codeql:
    needs: changes
    if: ${{ github.event_name == 'schedule' || needs.changes.outputs.run_full_ci == 'true' }}
    timeout-minutes: 30
    runs-on: ubuntu-latest
    permissions:
      actions: read
      contents: read
      security-events: write
    strategy:
      fail-fast: false
      matrix:
        # Python scans schema/tooling scripts; Actions scans workflow risks.
        # Go code in this repository is limited to tiny examples.
        # Starlark formatting/lint checks run in CI via Buildifier.
        language: ["python", "actions"]
    steps:
      - name: Checkout
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Initialize CodeQL
        uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
        with:
          languages: ${{ matrix.language }}

      - name: Analyze with CodeQL
        uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5