SQL

- ref: recent_logins
  action: core.sql.execute_query
  args:
    query: |
      SELECT user_email, last_login_at
      FROM user_logins
      WHERE last_login_at >= :cutoff
      ORDER BY last_login_at DESC
    bound_params:
      cutoff: ${{ TRIGGER.cutoff }}
    max_rows: 100

- ref: aggregate_results
  action: core.duckdb.execute_sql
  args:
    sql: |
      WITH findings(id, severity) AS (
        VALUES (1, 'high'), (2, 'low'), (3, 'high')
      )
      SELECT severity, count(*) AS count
      FROM findings
      GROUP BY severity
      ORDER BY count DESC

# Attach the amazon_s3 secret (static keys or AWS_ROLE_ARN for AssumeRole).
- ref: read_s3
  action: core.duckdb.execute_sql
  args:
    sql: |
      SELECT *
      FROM read_parquet('s3://my-bucket/findings/*.parquet')