From 55d6586ac197c87e9f1ff873cab3ced667a8d426 Mon Sep 17 00:00:00 2001
From: Lucien Bart <lucien.bart@sonarsource.com>
Date: Tue, 13 Oct 2026 14:29:02 +0200
Subject: [PATCH 1/2] CLP-1174 split unified dogfooding in two steps

---
 .github/workflows/unified-dogfooding.yml | 27 ++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/unified-dogfooding.yml b/.github/workflows/unified-dogfooding.yml
index 27427ff1b45..6d24d3dc7c5 100644
--- a/.github/workflows/unified-dogfooding.yml
+++ b/.github/workflows/unified-dogfooding.yml
@@ -4,19 +4,24 @@ on:
     - cron: "0 4 * * 1-5" # Run the workflow Mon-Fri at 04:00 UTC
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
-  unified-platform-dogfooding:
+  build:
     runs-on: warp-custom-ubuntu-24-04-l
-    name: Unified Platform Dogfooding
+    name: Build for Shadow Scan
     permissions:
       id-token: write
-      contents: read
+      contents: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1
         with:
           version: 2026.10.0
-      - uses: SonarSource/ci-github-actions/build-maven@v2
+      - name: SQC shadow scans
+        uses: SonarSource/ci-github-actions/build-maven@v2
         env:
           MAVEN_OPTS: "-Xmx8g"
           JAVA_TOOL_OPTIONS: ""
@@ -26,6 +31,20 @@ jobs:
           artifactory-reader-role: private-reader
           artifactory-deployer-role: qa-deployer
           scanner-java-opts: '-Xmx2g'
+
+  run_iris:
+    needs: [ build ]
+    if: ${{ !cancelled() && needs.build.result == 'success' }}
+    concurrency:
+      group: iris
+      cancel-in-progress: false
+      queue: single
+    runs-on: sonar-xs
+    name: Run IRIS
+    permissions:
+      id-token: write
+      contents: write
+    steps:
       - name: Run IRIS Analysis
         uses: SonarSource/unified-dogfooding-actions/run-iris@v1
         with:

From 2aac2238d8233218091889eb4f63fc0e0d80f135 Mon Sep 17 00:00:00 2001
From: Lucien Bart <lucien.bart@sonarsource.com>
Date: Tue, 13 Oct 2026 15:35:06 +0200
Subject: [PATCH 2/2] CLP-906 Lower permissions

---
 .github/workflows/unified-dogfooding.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/unified-dogfooding.yml b/.github/workflows/unified-dogfooding.yml
index 6d24d3dc7c5..d0164a30b03 100644
--- a/.github/workflows/unified-dogfooding.yml
+++ b/.github/workflows/unified-dogfooding.yml
@@ -14,7 +14,7 @@ jobs:
     name: Build for Shadow Scan
     permissions:
       id-token: write
-      contents: write
+      contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1
@@ -43,7 +43,7 @@ jobs:
     name: Run IRIS
     permissions:
       id-token: write
-      contents: write
+      contents: read
     steps:
       - name: Run IRIS Analysis
         uses: SonarSource/unified-dogfooding-actions/run-iris@v1