ci(sql): lint migrations and publish SARIF results

Author: phongphongg

.github/scripts/sqruff_to_sarif.py

@@ -0,0 +1,100 @@
+"""Convert sqruff JSON lint output to SARIF 2.1.0 format."""
+
+import hashlib
+import json
+import os
+from pathlib import Path
+from urllib.parse import quote
+
+SARIF_SCHEMA = "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json"
+SQRUFF_VERSION = "0.38.0"
+SEVERITY_MAP = {"Warning": "warning", "Error": "error", "Note": "note"}
+
+
+def uri(path: str) -> str:
+    return quote(path, safe="/")
+
+
+def to_region(r: dict) -> dict:
+    return {
+        "startLine":   max(r["start"]["line"], 1),
+        "startColumn": max(r["start"]["character"], 1),
+        "endLine":     max(r["end"]["line"], 1),
+        "endColumn":   max(r["end"]["character"], 1),
+    }
+
+
+def fingerprint(rule_id: str, file_uri: str, line: int, message: str) -> str:
+    return hashlib.sha256(f"{rule_id}:{file_uri}:{line}:{message}".encode()).hexdigest()
+
+
+def build_rule(rule_id: str) -> dict:
+    return {
+        "id": rule_id,
+        "shortDescription": {"text": f"sqruff rule {rule_id}"},
+        "helpUri": f"https://docs.sqruff.com/rules/{rule_id.lower()}",
+        "properties": {"tags": ["sql", "sqruff"]},
+    }
+
+
+def build_result(file_path: str, diag: dict) -> dict:
+    rule_id = diag.get("code") or "unknown"
+    file_uri = uri(file_path)
+    line = diag["range"]["start"]["line"]
+    message = diag["message"]
+
+    return {
+        "ruleId": rule_id,
+        "level": SEVERITY_MAP.get(diag.get("severity", "Warning"), "warning"),
+        "message": {"text": message},
+        "partialFingerprints": {"sqruffFingerprint/v1": fingerprint(rule_id, file_uri, line, message)},
+        "locations": [{
+            "physicalLocation": {
+                "artifactLocation": {"uri": file_uri, "uriBaseId": "%SRCROOT%"},
+                "region": to_region(diag["range"]),
+            }
+        }],
+    }
+
+
+def build_sarif(data: dict) -> dict:
+    pairs = [(fp, diag) for fp, diags in data.items() for diag in diags]
+    rules = sorted({diag.get("code") for _, diag in pairs if diag.get("code")})
+
+    return {
+        "$schema": SARIF_SCHEMA,
+        "version": "2.1.0",
+        "runs": [{
+            "tool": {
+                "driver": {
+                    "name": "sqruff",
+                    "informationUri": "https://github.com/quarylabs/sqruff",
+                    "version": SQRUFF_VERSION,
+                    "rules": [build_rule(r) for r in rules],
+                }
+            },
+            "results":   [build_result(fp, diag) for fp, diag in pairs],
+            "artifacts": [
+                {"location": {"uri": uri(fp), "uriBaseId": "%SRCROOT%"}}
+                for fp in data
+            ],
+        }],
+    }
+
+
+def main() -> None:
+    tmp = Path(os.environ["RUNNER_TEMP"])
+    input_path  = tmp / "sqruff-raw.json"
+    output_path = tmp / "sqruff.sarif"
+
+    data = json.loads(input_path.read_text())
+    output_path.write_text(json.dumps(build_sarif(data), indent=2))
+
+    total = sum(len(v) for v in data.values())
+    print(f"✅ {total} violation(s) across {len(data)} file(s) → {output_path}")
+    if not total:
+        print("🎉 No violations — clean SARIF will auto-close stale alerts")
+
+
+if __name__ == "__main__":
+    main()

.github/workflows/linter_formatter.yaml

@@ -0,0 +1,93 @@
+---
+name: Linter & Formatter
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number || github.ref_name }}
+  cancel-in-progress: true
+
+jobs:
+  prettier:
+    name: Prettier Formatter
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v6
+        with:
+          node-version: 25.9.0
+      - name: Init local project
+        run: npm init -y
+      - name: Install deps
+        run: |
+          npm install --save-dev prettier@3.8.3 @prettier/plugin-xml@3.4.2 prettier-plugin-java@2.8.1
+      - name: Run Prettier
+        run: |
+          npx prettier \
+            --config .prettierrc.yaml \
+            --write .
+      - id: verify_format
+        name: Verify no changes after formatting
+        run: |
+          changed_files="$(git diff --name-only)"
+
+          if [[ -z "$changed_files" ]]; then
+            echo "Code is properly formatted."
+            exit 0
+          fi
+
+          cat <<EOF
+          Code is not formatted properly. Please run Prettier locally and commit the changes.
+
+          Changed files:
+          $changed_files
+          EOF
+
+          printf 'changed_files<<EOF\n%s\nEOF\n' "$changed_files" >> "$GITHUB_OUTPUT"
+          exit 1
+      - if: failure()
+        name: Upload formatter results
+        uses: actions/upload-artifact@v7
+        with:
+          name: prettier-results
+          include-hidden-files: true
+          path: ${{ steps.verify_format.outputs.changed_files }}
+          retention-days: 1
+
+  yaml-linter:
+    name: YAML Linter
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@v5
+      - run: pip install yamllint==1.38.0
+      - run: yamllint -c .yamllint.yaml --format github --strict .
+
+  sqruff:
+    name: Lint with sqruff
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v5
+      - run: pip install sqruff==0.38.0
+      - name: Run sqruff lint
+        run: sqruff lint --format json . > ${{ runner.temp }}/sqruff-raw.json
+      - name: Convert sqruff JSON to SARIF
+        if: always()
+        run: python .github/scripts/sqruff_to_sarif.py
+      - if: always()
+        name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: ${{ runner.temp }}/sqruff.sarif
+          category: sqruff

.sqruff

@@ -0,0 +1,8 @@
+[sqruff]
+dialect = postgres
+exclude_rules = LT05
+rules = all
+
+[sqruff:indentation]
+indent_unit = space
+tab_space_size = 4

.squawk.toml

@@ -0,0 +1,7 @@
+pg_version = "18.0"
+
+excluded_rules = [
+    "require-timeout-settings",
+]
+
+assume_in_transaction = true