bigquery-agent-analytics 0.6.1__tar.gz → 0.7.0__tar.gz

bigquery_agent_analytics-0.7.0/.github/workflows/ci.yml

@@ -0,0 +1,193 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  # A merge queue merges a group of pull requests only once the required
+  # checks pass on the group's commit, and only this event runs them there.
+  merge_group:
+    types: [checks_requested]
+
+# Least privilege: no job here needs write access to repo contents.
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  format:
+    name: Format check
+    runs-on: ubuntu-22.04
+    steps:
+      # Full history: the sync_generation check below reads the binding at
+      # an earlier commit.
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Reject SDLC working notes (intent.md / plan.md / spec.md)
+        run: |
+          found="$(find . -path ./.git -prune -o -type f \( -name intent.md -o -name plan.md -o -name spec.md \) -print)"
+          if [ -n "$found" ]; then
+            echo "$found"
+            echo "::error::intent.md / plan.md / spec.md must not be checked in. Keep SDLC working notes outside this repo."
+            exit 1
+          fi
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        with:
+          python-version: "3.12"
+
+      - name: Install formatting tools
+        run: pip install "pyink>=24.3.0,<26" "isort>=5.0"
+
+      - name: Run autoformat and check for changes
+        run: |
+          bash autoformat.sh
+          if ! git diff --exit-code src/ tests/ examples/ scripts/ dashboards/; then
+            echo ""
+            echo "::error::Code is not formatted. Run 'bash autoformat.sh' and commit the changes."
+            exit 1
+          fi
+
+      - name: Check codelab notebook is in sync with markdown source
+        run: |
+          python scripts/generate_colab_from_codelab.py --check \
+            docs/codelabs/periodic_materialization.md \
+            examples/context_graph/codelab/colab_notebook.ipynb
+
+      - name: Install PyYAML
+        run: pip install "pyyaml>=6.0"
+
+      # A committed receipt records one sync generation. Comparing with the
+      # binding on the base branch (or the merge group's base, or before this
+      # push) keeps a change from moving the generation back to one whose
+      # receipt it still holds. This is the only check that does, so it runs
+      # in this job: Format check is a required status check, and a failure
+      # here blocks the merge. A merge group has neither BASE_REF nor BEFORE,
+      # so it compares with its base_sha, which every group has. The step
+      # skips only a push with nothing before it (BEFORE empty or all zeros)
+      # and a previous commit without the binding; a merge base, a merge
+      # group's base_sha or a BEFORE commit that this clone cannot find fails
+      # it. tests/test_ci_workflow.py runs this script.
+      - name: Check that sync_generation only moves forward
+        shell: bash
+        env:
+          BASE_REF: ${{ github.base_ref }}
+          BEFORE: ${{ github.event.before }}
+          MERGE_GROUP_BASE: ${{ github.event.merge_group.base_sha }}
+        run: |
+          binding=dashboards/looker_studio/bindings/bqca_report_template.yaml
+          if [ "$GITHUB_EVENT_NAME" = merge_group ]; then
+            if [ -z "${MERGE_GROUP_BASE//0/}" ] || ! git cat-file -e "$MERGE_GROUP_BASE^{commit}" 2>/dev/null; then
+              echo "::error::cannot compare $binding with the merge group's base: base_sha '$MERGE_GROUP_BASE' is not a commit in this clone"
+              exit 1
+            fi
+            previous="$MERGE_GROUP_BASE"
+          elif [ -n "$BASE_REF" ]; then
+            if ! previous="$(git merge-base HEAD "origin/$BASE_REF")"; then
+              echo "::error::cannot compare $binding with the base branch: no merge base of HEAD and origin/$BASE_REF in this clone"
+              exit 1
+            fi
+          elif [ -z "${BEFORE//0/}" ]; then
+            echo "no previous $binding to compare with"
+            exit 0
+          elif git cat-file -e "$BEFORE^{commit}" 2>/dev/null; then
+            previous="$BEFORE"
+          else
+            echo "::error::cannot compare $binding with the commit before this push: $BEFORE is not in this clone"
+            exit 1
+          fi
+          if ! git cat-file -e "$previous:$binding" 2>/dev/null; then
+            echo "no $binding at $previous to compare with"
+            exit 0
+          fi
+          git show "$previous:$binding" > "$RUNNER_TEMP/previous-binding.yaml"
+          python dashboards/looker_studio/tools/validate_contracts.py --profile bqca \
+            --previous-binding "$RUNNER_TEMP/previous-binding.yaml"
+
+  test:
+    name: Test (Python ${{ matrix.python-version }})
+    runs-on: ubuntu-22.04
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install package with dev dependencies
+        run: pip install -e ".[dev,streamlit]"
+
+      - name: Run tests
+        run: pytest --tb=short -q
+
+  configurator-browser-smoke:
+    name: Configurator browser smoke
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+
+      - name: Run the smoke check's own negative fixtures
+        run: bash dashboards/looker_studio/tools/browser_smoke.sh --self-test
+
+      - name: Load the configurator in headless Chrome
+        run: bash dashboards/looker_studio/tools/browser_smoke.sh
+
+  build:
+    name: Build package
+    runs-on: ubuntu-22.04
+    needs: [format, test]
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        with:
+          python-version: "3.12"
+
+      - name: Install build tools
+        run: pip install build
+
+      - name: Build sdist and wheel
+        run: python -m build
+
+      - name: Verify package version
+        run: |
+          VERSION=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          echo "Package version: ${VERSION}"
+          ls -la dist/
+          ls dist/ | grep "${VERSION}" || (echo "Version mismatch in built artifacts" && exit 1)
+
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
+        with:
+          name: dist
+          path: dist/

bigquery_agent_analytics-0.7.0/.github/workflows/codemender.yml

@@ -0,0 +1,197 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Scans the changes in each pull request into main with CodeMender
+# (`cm find --diff` against the base branch), uploads the SARIF report to
+# GitHub code scanning (category `codemender`), and fails when CodeMender
+# finds a vulnerability with a severity in FAIL_ON. A manual run
+# (workflow_dispatch) scans the last commit of the branch it runs on.
+#
+# The job authenticates to Google Cloud with Workload Identity Federation,
+# from the repository secrets GCP_PROJECT_ID, GCP_WIF_PROVIDER and
+# GCP_WIF_SERVICE_ACCOUNT. To set them up, see
+# https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents/codemender/integrate-with-cicd#github-wif
+# Until all three are set, the job skips the scan with a notice and passes.
+#
+# Workflows for pull requests from forks and from Dependabot can't read the
+# secrets, so the job doesn't run for them, and GitHub reports a skipped job
+# as successful: even as a required check, it wouldn't block those pull
+# requests. Review them yourself, or scan them locally with `cm find --diff`
+# (see scripts/codemender_pre_commit.sh).
+#
+# tests/test_codemender_workflow.py runs this workflow's scripts.
+
+name: CodeMender
+
+on:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+# Least privilege: the scan job asks for the permissions it needs.
+permissions: {}
+
+concurrency:
+  group: codemender-${{ github.ref }}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    shell: bash
+
+env:
+  CM_DOWNLOAD_URL: https://artifactregistry.googleapis.com/download/v1/projects/cmoc-prod/locations/us/repositories/codemender-cli-production/files/cm%3Astable%3Acm-linux-amd64.zip:download?alt=media
+
+jobs:
+  scan:
+    name: CodeMender scan
+    # Workflows for fork and Dependabot pull requests can't read this
+    # repository's secrets, so they can't authenticate to Google Cloud.
+    if: >-
+      (github.event_name == 'workflow_dispatch' ||
+      github.event.pull_request.head.repo.full_name == github.repository) &&
+      github.actor != 'dependabot[bot]'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write         # Workload Identity Federation
+      security-events: write  # Upload SARIF to code scanning
+      actions: read           # Upload SARIF from a private repository
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          fetch-depth: 0  # cm needs the base branch history
+          persist-credentials: false
+
+      - name: Check Workload Identity Federation configuration
+        id: check_config
+        env:
+          GCP_PROJECT_ID: ${{ secrets.GCP_PROJECT_ID }}
+          GCP_WIF_PROVIDER: ${{ secrets.GCP_WIF_PROVIDER }}
+          GCP_WIF_SERVICE_ACCOUNT: ${{ secrets.GCP_WIF_SERVICE_ACCOUNT }}
+        run: |
+          # A secret that isn't set reads as "". The auth action trims its
+          # inputs, so a secret of only whitespace counts as not set too.
+          missing=()
+          for name in GCP_PROJECT_ID GCP_WIF_PROVIDER GCP_WIF_SERVICE_ACCOUNT; do
+            value="${!name}"
+            if [ -z "${value//[[:space:]]/}" ]; then
+              missing+=("$name")
+            fi
+          done
+          if [ "${#missing[@]}" -ne 0 ]; then
+            echo "::notice::CodeMender WIF secrets (GCP_PROJECT_ID, GCP_WIF_PROVIDER, GCP_WIF_SERVICE_ACCOUNT) are not configured; skipping CodeMender scan."
+            printf -v names '%s, ' "${missing[@]}"
+            {
+              echo "## CodeMender scan"
+              echo
+              echo "Skipped: these repository secrets are not set: ${names%, }."
+              echo "To set them up, see [Integrate CodeMender with CI/CD](https://docs.cloud.google.com/gemini-enterprise-agent-platform/agents/codemender/integrate-with-cicd#github-wif)."
+            } >> "$GITHUB_STEP_SUMMARY"
+            echo "configured=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "configured=true" >> "$GITHUB_OUTPUT"
+
+      - name: Authenticate to Google Cloud
+        if: steps.check_config.outputs.configured == 'true'
+        uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed  # v2.1.13
+        with:
+          project_id: ${{ secrets.GCP_PROJECT_ID }}
+          workload_identity_provider: ${{ secrets.GCP_WIF_PROVIDER }}
+          service_account: ${{ secrets.GCP_WIF_SERVICE_ACCOUNT }}
+
+      - name: Install the CodeMender CLI
+        if: steps.check_config.outputs.configured == 'true'
+        run: |
+          curl -fsSL -o "$RUNNER_TEMP/cm.zip" "$CM_DOWNLOAD_URL"
+          unzip -q -o "$RUNNER_TEMP/cm.zip" -d "$RUNNER_TEMP/cm"
+          echo "$RUNNER_TEMP/cm" >> "$GITHUB_PATH"
+
+      - name: Scan the pull request
+        id: scan
+        if: steps.check_config.outputs.configured == 'true'
+        env:
+          BASE_REF: ${{ github.base_ref }}
+          # Severities that fail the check: CRITICAL, HIGH, MEDIUM and LOW,
+          # comma-separated. "" reports the findings without failing.
+          FAIL_ON: CRITICAL,HIGH
+        run: |
+          # A pull request is compared with its base branch; a manual run with
+          # the commit before HEAD, or with main when HEAD has no parent.
+          if [ "$GITHUB_EVENT_NAME" = pull_request ]; then
+            diff_ref="origin/$BASE_REF"
+          elif git rev-parse --verify --quiet 'HEAD~1^{commit}' > /dev/null; then
+            diff_ref=HEAD~1
+          else
+            diff_ref=origin/main
+          fi
+          if ! git rev-parse --verify --quiet "$diff_ref^{commit}" > /dev/null; then
+            echo "::error::cannot scan the changes: '$diff_ref' is not a commit in this clone"
+            exit 1
+          fi
+
+          # Only a report that this scan writes is summarized and uploaded.
+          rm -f codemender.sarif
+          cm init
+          status=0
+          cm find . \
+            --diff="$diff_ref" \
+            --diff-workers=16 \
+            --fail-on="$FAIL_ON" \
+            --format=sarif \
+            --output=codemender.sarif \
+            --sandbox=false \
+            --yes \
+            --bypass-warning || status=$?
+
+          # Anyone can read the job summary of a public repository, so it has
+          # the outcome but not the findings. Code scanning has them: it
+          # annotates the pull request, and its alert list needs write access.
+          # (`cm report` would also list findings in code that the change
+          # didn't touch, labeled [LEGACY / UNTOUCHED].)
+          # cm find exits with 1 for a vulnerability with a failing severity;
+          # any other failure, or 1 without a report, is an error.
+          if [ "$status" -eq 0 ]; then
+            outcome="Passed: no vulnerability with a failing severity."
+          elif [ "$status" -eq 1 ] && [ -f codemender.sarif ]; then
+            outcome="Failed (exit status 1): CodeMender reported a vulnerability with a failing severity."
+          elif [ -f codemender.sarif ]; then
+            outcome="Failed (exit status $status): the scan failed after writing its report; see this step's log."
+          else
+            outcome="Failed (exit status $status): the scan wrote no report; see this step's log."
+          fi
+          {
+            echo "## CodeMender scan"
+            echo
+            echo "Compared with \`$diff_ref\`. Failing severities: ${FAIL_ON:-none (findings are only reported)}."
+            echo
+            echo "$outcome"
+            if [ -f codemender.sarif ]; then
+              echo
+              echo "The findings are in [code scanning]($GITHUB_SERVER_URL/$GITHUB_REPOSITORY/security/code-scanning) (category \`codemender\`); its alert list needs write access."
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"
+          exit "$status"
+
+      # Code scanning has to be available for the repository; if it isn't,
+      # the upload fails without failing the job.
+      - name: Upload results to code scanning
+        if: ${{ !cancelled() && steps.check_config.outputs.configured == 'true' && hashFiles('codemender.sarif') != '' }}
+        continue-on-error: true
+        uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066  # v4.39.3
+        with:
+          sarif_file: codemender.sarif
+          category: codemender

bigquery_agent_analytics-0.7.0/.github/workflows/external-access-staleness.yml

@@ -0,0 +1,88 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Wall-clock half of the external-access attestation contract (#445): the
+# unit tests enforce the attestation's internal consistency but never compare
+# its dates to today, so this scheduled run is what makes the monthly manual
+# canary recur. When next_due_date has passed it opens (or bumps) a tracking
+# issue and fails, making the staleness visible without touching any
+# credentialed API.
+#
+# Split into a read job and a write job on purpose: the check job holds only
+# contents: read and installs nothing (the script is stdlib-only), and the
+# issue-writing job that receives a token downloads no packages and performs
+# no checkout — so no freshly resolved dependency ever executes in a job
+# that holds write authority.
+
+name: External access attestation staleness
+
+on:
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  check:
+    name: next_due_date has not passed
+    runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+    outputs:
+      overdue: ${{ steps.staleness.outputs.overdue }}
+      message: ${{ steps.staleness.outputs.message }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+
+      - name: Check attestation staleness
+        id: staleness
+        run: |
+          if message=$(python3 scripts/check_external_access_staleness.py 2>&1); then
+            echo "$message"
+            echo "overdue=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "$message"
+            printf 'message<<EOF\n%s\nEOF\n' "$message" >> "$GITHUB_OUTPUT"
+            echo "overdue=true" >> "$GITHUB_OUTPUT"
+          fi
+
+  report:
+    name: Open or bump the tracking issue
+    needs: check
+    if: needs.check.outputs.overdue == 'true'
+    runs-on: ubuntu-22.04
+    permissions:
+      issues: write
+    steps:
+      - name: Open or bump the tracking issue
+        env:
+          GH_TOKEN: ${{ github.token }}
+          MESSAGE: ${{ needs.check.outputs.message }}
+        run: |
+          title="External access attestation overdue"
+          body="$MESSAGE
+
+          Protocol: dashboards/looker_studio/bindings/report_template.yaml (#445) and dashboards/looker_studio/bindings/bqca_report_template.yaml (#515) -> external_access_verification."
+          existing=$(gh issue list --repo "$GITHUB_REPOSITORY" --state open \
+            --search "\"$title\" in:title" --json number --jq '.[0].number // empty')
+          if [ -n "$existing" ]; then
+            gh issue comment "$existing" --repo "$GITHUB_REPOSITORY" --body "$body"
+          else
+            gh issue create --repo "$GITHUB_REPOSITORY" --title "$title" \
+              --body "$body" --label bug
+          fi
+          exit 1

bigquery_agent_analytics-0.7.0/.github/workflows/looker-studio-pages.yml

@@ -0,0 +1,59 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Deploy Looker Studio configurator
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "dashboards/looker_studio/docs/**"
+      - "dashboards/power_bi/docs/**"
+      - "dashboards/power_bi/screenshots/**"
+      - ".github/workflows/looker-studio-pages.yml"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+
+concurrency:
+  group: looker-studio-pages
+  cancel-in-progress: true
+
+jobs:
+  deploy:
+    if: github.ref == 'refs/heads/main'
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4.3.1
+        with:
+          persist-credentials: false
+      - name: Stage Power BI configurator and screenshots under /power-bi
+        run: |
+          rm -rf dashboards/looker_studio/docs/power-bi
+          mkdir -p dashboards/looker_studio/docs/screenshots
+          cp -R dashboards/power_bi/docs dashboards/looker_studio/docs/power-bi
+          cp -R dashboards/power_bi/screenshots/. dashboards/looker_studio/docs/screenshots/
+      - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b  # v5
+      - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b  # v4
+        with:
+          path: dashboards/looker_studio/docs
+      - name: Deploy
+        id: deployment
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e  # v4

bigquery_agent_analytics-0.7.0/.github/workflows/power-bi-sync-check.yml

@@ -0,0 +1,82 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: Power BI sync check
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "dashboards/power_bi/**"
+      - "dashboards/looker_studio/spec/**"
+      - "dashboards/looker_studio/sql/events_v1.sql.tmpl"
+      - "dashboards/looker_studio/oracle/queries/**"
+      - "tests/test_power_bi_*.py"
+      - "pyproject.toml"
+      - ".github/workflows/power-bi-sync-check.yml"
+  pull_request:
+    branches: [main]
+    paths:
+      - "dashboards/power_bi/**"
+      - "dashboards/looker_studio/spec/**"
+      - "dashboards/looker_studio/sql/events_v1.sql.tmpl"
+      - "dashboards/looker_studio/oracle/queries/**"
+      - "tests/test_power_bi_*.py"
+      - "pyproject.toml"
+      - ".github/workflows/power-bi-sync-check.yml"
+  # A merge queue merges a group of pull requests only once the required
+  # checks pass on the group's commit, and only this event runs them there.
+  merge_group:
+    types: [checks_requested]
+
+permissions:
+  contents: read
+
+jobs:
+  power-bi-sync:
+    name: Power BI project is in sync and valid
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4.4.0
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5
+        with:
+          python-version: "3.12"
+
+      - name: Install dependencies
+        # Exact versions: validator behavior must only change through a
+        # repository diff, like the SHA-pinned actions and schema lock.
+        run: pip install "pyyaml==6.0.2" "jsonschema==4.23.0" "pytest==8.3.4"
+
+      - name: Check generated files are in sync
+        run: |
+          python3 dashboards/power_bi/tools/generate_pbip.py --check
+
+      - name: Fetch pinned PBIR schemas
+        run: |
+          python3 dashboards/power_bi/tools/validate_pbip.py \
+            --fetch-schemas "$RUNNER_TEMP/pbir-schemas"
+
+      - name: Validate against pinned schemas
+        run: |
+          python3 dashboards/power_bi/tools/validate_pbip.py \
+            --schemas-dir "$RUNNER_TEMP/pbir-schemas"
+
+      - name: Run Power BI tests
+        env:
+          BQAA_POWER_BI_SCHEMAS_DIR: ${{ runner.temp }}/pbir-schemas
+        run: |
+          pytest --tb=short -q tests/test_power_bi_*.py