Repository navigation
feat: add SQBRPYTHON orchestration, test and purity rules, Python tests and secret-free commands - #1497
Merged
chio-labs-delivery[bot] merged 6 commits intoNov 15, 2026
Conversation
- Compile: a sensor or calendar declared inside a `_`-prefixed folder under orchestration/sensors/ or orchestration/calendars/ now fails with an error naming the file, since such folders are private support. - SQBRPYTHON016-020: module paths, private support, module surface, import direction and no docstring on sensor and calendar functions. - Provider and orchestration rules share parsing and import resolution. - Evict nested namespace packages before their parents between projects in one interpreter, so a project importing orchestration.* no longer breaks the next compile. - Docs and DuckShop fixtures for each rule.
A provider whose required secret settings are unset no longer stops every command. Static commands (compile, dag, format, scope, lineage, rules run) still fail with D012 naming the variable, unless --allow-missing-secrets, SQLBUILD_ALLOW_MISSING_SECRETS or the local allow_missing_secrets setting allows it. The project file rejects that setting. build, load and check read secrets only for the providers the selected nodes and sinks use, and fail before anything runs when one is missing. Providers are instantiated lazily in the runtime session. sqb debug reports how many providers are ready and lists missing secrets (--verbose lists every one). Location health reports missing_secrets and exits 1, and the Providers page marks unset secret settings.
…PYTHON rules sqb test now runs the project's pytest modules under tests/python/ and tests/providers/ after its SQL tests, from the project directory with --import-mode=importlib. --sql and --python pick one kind. Selecting a Python node runs the tests in its mirrored folder; selecting only models or unit tests runs none. The command fails when either kind fails, and fails early when Python tests exist but pytest is not installed. sqb test --since, --inspect, review and ad-hoc runs stay SQL-only, and sqb build never runs Python tests. With --json, pytest writes to stderr. - SQBRPYTHON021: a test sits in the folder mirroring the code it tests, and test_<name>.py has a <name>.py or <name>/ beside that code. - SQBRPYTHON701-724: the Fensu test-shape rules (table-driven dataclass cases, naming, parametrize ids), applied only to Python tests. - Docs for sqb test, sqb build, testing, project layout, custom rule tests and the Python Rules reference, plus DuckShop fixtures.
sqb compile imports project Python with no warehouse connection, so the code that runs then must not reach outside the machine. SQBRPYTHON022 checks calls at module scope, in class bodies and directly in @factory bodies, follows the project functions they call through their imports, and reports a call that reaches a subprocess, an HTTP request, a socket, a database or warehouse driver, or a cloud or SSH client. It reads source only and follows only calls it can resolve, so a call through a variable or an object is never reported. - approved_loader_boundaries lists exact project functions the walk does not enter; a glob fails configuration and a module name fails the run. - Findings are reported at the root call and name the external call and where it is. Results per function are memoized, with a scaling test over deep shared call chains. - Docs for the rule, its option and its reference row, and a DuckShop violation behind a branch compile never takes.
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Nov 15, 2026
chio-labs-delivery
Bot
deleted the
feat/sqbrpython-orchestration-secrets-tests-purity
branch
November 15, 2026 13:31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Four related project-Python changes for one release: orchestration rules, commands that don't need unrelated provider secrets, project Python tests in
sqb test, and a rule keeping compile-time Python off external systems.Changes
_-prefixed orchestration folder fails compile.--allow-missing-secretsallows it.sqb debugand location health report missing secrets.sqb testruns pytest modules undertests/python/andtests/providers/after SQL tests (--sql,--python; Python node selection runs its mirrored folder). SQBRPYTHON021 and 701–724 check test placement and shape.@factorybodies to subprocess, network, database and remote-client calls;approved_loader_boundarieslists exact exceptions.DuckShop: orchestration, Python-test and compile-time purity cases added to the Python-rules edge cases; provider secrets are runtime behaviour with no project shape, covered by E2E tests.
Verification
sqb testwith Python tests (selection, JSON) and regressions; Python-rules integration tests;make test(launcher and Docker cases left to CI).make check-cion the final head.python_scalinggrowth ratio is 6.5–6.8 against a 6.5 limit here, as on main.failure/local-config-unknown-keychanged:allow_missing_secretsis a new local key.BEGIN_COMMIT_OVERRIDE
feat: add SQBRPYTHON rules for orchestration sensors and calendars
feat: run commands without provider secrets they don't need
feat: run project Python tests with sqb test and check them with SQBRPYTHON rules
feat: add SQBRPYTHON022 compile-time purity rule
END_COMMIT_OVERRIDE