datacontract-cli 1.1.1__tar.gz → 1.1.2__tar.gz

datacontract_cli-1.1.2/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Entropy Data GmbH
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

{datacontract_cli-1.1.1/datacontract_cli.egg-info → datacontract_cli-1.1.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: datacontract-cli
-Version: 1.1.1
+Version: 1.1.2
 Summary: The datacontract CLI is an open source command-line tool for working with Data Contracts. It uses data contract YAML files to lint the data contract, connect to data sources and execute schema and quality tests, detect breaking changes, and export to different formats. The tool is written in Python. It can be used as a standalone CLI tool, in a CI/CD pipeline, or directly as a Python library.
 Author-email: Jochen Christ <jochen.christ@entropy-data.com>, Stefan Negele <stefan.negele@innoq.com>, Simon Harrer <simon.harrer@entropy-data.com>
 License-Expression: MIT
@@ -49,7 +49,7 @@ Requires-Dist: datacontract-specification<2.0.0,>=1.2.3
 Requires-Dist: open-data-contract-standard<4.0.0,>=3.1.2
 Requires-Dist: deepdiff<10.0.0,>=6.0.0
 Provides-Extra: avro
-Requires-Dist: avro==1.12.1; extra == "avro"
+Requires-Dist: avro==1.12.2; extra == "avro"
 Provides-Extra: bigquery
 Requires-Dist: ibis-framework[bigquery]<13.0.0,>=10.0.0; extra == "bigquery"
 Provides-Extra: csv
@@ -67,7 +67,7 @@ Requires-Dist: rich>=12.4.4; extra == "dataframe"
 Provides-Extra: databricks
 Requires-Dist: ibis-framework[databricks]<13.0.0,>=10.0.0; extra == "databricks"
 Requires-Dist: databricks-sql-connector<4.5.0,>=3.7.0; extra == "databricks"
-Requires-Dist: databricks-sdk<0.126.0; extra == "databricks"
+Requires-Dist: databricks-sdk<0.134.0; extra == "databricks"
 Requires-Dist: packaging<27.0,>=21.3; extra == "databricks"
 Provides-Extra: databricks-runtime
 Requires-Dist: datacontract-cli[databricks]; extra == "databricks-runtime"
@@ -143,13 +143,14 @@ Requires-Dist: openapi-spec-validator<0.10,>=0.7; extra == "dev"
 Requires-Dist: pandas>=2.1.0; extra == "dev"
 Requires-Dist: pre-commit<4.7.0,>=3.7.1; extra == "dev"
 Requires-Dist: pytest; extra == "dev"
+Requires-Dist: pytest-cov; extra == "dev"
 Requires-Dist: pytest-xdist; extra == "dev"
 Requires-Dist: pymssql==2.3.13; extra == "dev"
 Requires-Dist: psycopg2-binary<3.0,>=2.9; extra == "dev"
 Requires-Dist: mysql-connector-python<26.8.0,>=8.0.30; extra == "dev"
-Requires-Dist: ruff==0.16.2; extra == "dev"
+Requires-Dist: ruff==0.16.4; extra == "dev"
 Requires-Dist: testcontainers[kafka,minio,mssql,mysql,postgres]==4.15.0; extra == "dev"
-Requires-Dist: trino==0.338.0; extra == "dev"
+Requires-Dist: trino==0.339.0; extra == "dev"
 Dynamic: license-file
 
 # Data Contract CLI

{datacontract_cli-1.1.1 → datacontract_cli-1.1.2}/datacontract/api.py

@@ -1,6 +1,7 @@
 import json
 import logging
 import os
+import secrets
 import tempfile
 from importlib import metadata
 from typing import Annotated, Optional
@@ -8,7 +9,6 @@ from typing import Annotated, Optional
 import pydantic
 import yaml
 from fastapi import Body, Depends, FastAPI, HTTPException, Query, Request, status
-from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import PlainTextResponse
 from fastapi.security.api_key import APIKeyHeader
 from pydantic import BaseModel, Field, ValidationError
@@ -16,7 +16,7 @@ from pydantic import BaseModel, Field, ValidationError
 from datacontract.config import Config, known_env_names
 from datacontract.data_contract import DataContract, ExportFormat
 from datacontract.model.changelog import ChangelogEntry
-from datacontract.model.exceptions import DataContractException
+from datacontract.model.exceptions import DataContractException, DefinitionResolutionError
 from datacontract.model.run import Check, ResultEnum, Run
 
 DATA_CONTRACT_EXAMPLE_PAYLOAD = """apiVersion: v3.1.0
@@ -251,6 +251,16 @@ that value, and answers `401` when the header is missing and `403` when it is wr
 Securing the API is strongly recommended: `POST /test` connects to your data sources, and test
 results may contain sensitive information.
 
+## Contracts are untrusted
+
+A posted contract carries SQL and names the hosts to connect to, so the server treats it as
+untrusted input: a `quality.type: sql` rule must be a read-only query, a credential held in the
+server's environment is never sent to a host the contract names, a `publish_url` may only point at
+the Entropy Data platform or the host configured via `ENTROPY_DATA_HOST`, and `servers[].type: local`
+is refused so a caller cannot read the server's own files. Set
+`DATACONTRACT_CLI_API_ALLOW_LOCAL_FILES=true` if the deployment serves its own files on purpose;
+the contract is then still confined to the paths it declares.
+
 ## Connecting to data sources
 
 `POST /test` needs credentials for the server described in the contract's `servers` section. Provide
@@ -334,12 +344,17 @@ def _openapi_with_external_docs() -> dict:
 
 app.openapi = _openapi_with_external_docs
 
-app.add_middleware(
-    CORSMiddleware,
-    allow_origins=["*"],
-    allow_methods=["*"],
-    allow_headers=["*"],
-)
+# Contracts posted to this server arrive over HTTP from callers we do not trust,
+# so a credential the server holds in its environment must never be sent to a
+# host the contract names. The `edit` server reuses the `test` handler for a
+# local file the user owns, so it does not set this flag and is not guarded.
+app.state.untrusted_contracts = True
+
+# No CORS middleware: the only browser client is the Swagger UI served at "/",
+# which is same-origin and therefore not subject to CORS. Every other client
+# (curl, the SDK, CI) is not a browser and ignores CORS. Allowing arbitrary
+# origins would only let a page the operator happens to visit drive this server
+# and read its responses, so the safe default is to send no CORS headers at all.
 
 api_key_header = APIKeyHeader(
     name="x-api-key",
@@ -446,6 +461,198 @@ def _parse_filters_query(filters: str | None) -> dict[str, str] | None:
     return {schema_name: predicate.strip() for schema_name, predicate in parsed.items()}
 
 
+# For each server type whose connection host can be taken from the posted
+# contract: (the Server attribute that names the connection target, the Config
+# field an operator sets to pin that target in the environment or None when the
+# type has no such field, the Config fields that hold a connection secret).
+# See _reject_environment_credentials_to_untrusted_host.
+_ENVIRONMENT_CREDENTIAL_TARGETS: dict[str, tuple[str, str | None, tuple[str, ...]]] = {
+    "postgres": ("host", "postgres_host", ("postgres_password",)),
+    "mysql": ("host", "mysql_host", ("mysql_password",)),
+    "oracle": ("host", "oracle_host", ("oracle_password",)),
+    "impala": ("host", "impala_host", ("impala_password",)),
+    "trino": ("host", "trino_host", ("trino_password",)),
+    "redshift": ("host", "redshift_host", ("redshift_password",)),
+    "sqlserver": ("host", "sqlserver_host", ("sqlserver_password",)),
+    "snowflake": (
+        "account",
+        "snowflake_account",
+        ("snowflake_password", "snowflake_token", "snowflake_private_key"),
+    ),
+    "databricks": ("host", "databricks_server_hostname", ("databricks_token", "databricks_client_secret")),
+    # Kafka's broker host is always the contract's `server.host` (no environment
+    # option pins it), so an environment-held SASL password can never be paired
+    # with a posted contract safely -- host_field is None, so it is always rejected.
+    "kafka": ("broker host", None, ("kafka_sasl_password",)),
+}
+
+
+def _selected_server(body: str, server_name: str | None, config):
+    """The server the request would test, or None if that cannot be determined.
+
+    A contract that does not resolve, or that names no such server, is reported
+    by test() itself -- the guards below simply have nothing to check.
+    """
+    from datacontract.engines.data_contract_test import get_server
+    from datacontract.lint import resolve
+
+    try:
+        data_contract = resolve.resolve_data_contract(data_contract_str=body, config=config)
+        return get_server(data_contract, server_name)
+    except Exception:
+        return None
+
+
+# Server types that read their data through the local filesystem of the machine
+# running the test, rather than from a remote data source.
+_LOCAL_SERVER_TYPES = frozenset({"local", "duckdb"})
+
+ALLOW_LOCAL_FILES_ENV = "DATACONTRACT_CLI_API_ALLOW_LOCAL_FILES"
+_TRUTHY = frozenset({"1", "true", "yes", "on"})
+
+
+def _local_files_allowed() -> bool:
+    """Whether the operator opted in to serving data from the server's own disk.
+
+    Off by default. A deployment that mounts the data next to the API -- the data
+    directory in the container, say -- turns it on, accepting that a caller then
+    picks the path.
+    """
+    return (os.getenv(ALLOW_LOCAL_FILES_ENV) or "").strip().lower() in _TRUTHY
+
+
+def _reject_local_server_type(body: str, server_name: str | None, config) -> None:
+    """Keep a posted contract from reading the server's own disk.
+
+    `type: local` points the test at a path on the machine running it. For the
+    API server that machine is not the caller's, so the path is not theirs to
+    name -- and the result would tell them what is in it.
+    """
+    from datacontract.config import Config
+
+    if _local_files_allowed():
+        return
+    server = _selected_server(body, server_name, Config.resolve(config))
+    if server is None or server.type not in _LOCAL_SERVER_TYPES:
+        return
+    raise HTTPException(
+        status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+        detail=(
+            f"Server type '{server.type}' reads from the file system of the server running this API, "
+            f"so it is refused. Use a server type that names a data source, such as s3, gcs, azure, "
+            f"postgres, or snowflake — or set {ALLOW_LOCAL_FILES_ENV}=true if this deployment serves "
+            f"its own files on purpose."
+        ),
+    )
+
+
+def _reject_environment_credentials_to_untrusted_host(body: str, server_name: str | None, config) -> None:
+    """Keep an environment-held data-source credential from reaching a host the
+    posted contract chose.
+
+    A contract that arrives over HTTP is untrusted. If it could name the
+    connection host (its ``servers`` section) while the server supplies the
+    password from its own environment, an attacker could point the host at their
+    own machine and capture that password. So when a credential for the selected
+    server's type resolves from the environment, the connection target must
+    resolve from the environment too -- not from the contract, and not from a
+    per-request header (a caller who brings the whole credential set may still
+    aim it wherever they like; only the server's environment secret is pinned).
+    """
+    from datacontract.config import Config
+    from datacontract.config.settings import env_name
+
+    resolved = Config.resolve(config)
+    server = _selected_server(body, server_name, resolved)
+    if server is None:
+        return
+    guard = _ENVIRONMENT_CREDENTIAL_TARGETS.get(server.type)
+    if guard is None:
+        return
+    target_attr, host_field, secret_fields = guard
+    if not any(resolved.option_source(field) == "env" for field in secret_fields):
+        return  # no environment-held secret for this server type; nothing to protect
+    if host_field is not None and resolved.option_source(host_field) == "env":
+        return  # the operator pinned the target host; the contract's host is ignored
+    if host_field is not None:
+        env_var = env_name(host_field, Config.model_fields[host_field])
+        detail = (
+            f"This server holds a {server.type} credential in its environment, so the connection "
+            f"{target_attr} must also come from the server's environment ({env_var}); it will not be "
+            f"taken from the posted data contract. Set {env_var}, or send the full set of credentials "
+            f"with the request instead of relying on the server's environment."
+        )
+    else:
+        detail = (
+            f"This server holds a {server.type} credential in its environment, but its {target_attr} "
+            f"can only come from the posted data contract, so the credential cannot be pinned to a "
+            f"trusted target. Send the credentials with the request instead of relying on the server's "
+            f"environment."
+        )
+    raise HTTPException(status_code=status.HTTP_422_UNPROCESSABLE_ENTITY, detail=detail)
+
+
+# The fields backing the platform API key and host, in the fallback order
+# _get_api_key / _get_host read them (current name first, deprecated synonyms after).
+_PLATFORM_KEY_FIELDS = ("entropy_data_api_key", "datamesh_manager_api_key", "datacontract_manager_api_key")
+_PLATFORM_HOST_FIELDS = ("entropy_data_host", "datamesh_manager_host", "datacontract_manager_host")
+
+
+def _reject_unpinned_publish_url(publish_url: str | None) -> None:
+    """Keep the API server from POSTing test results to a caller-chosen host.
+
+    `publish_url` names where the finished run — check details, failed-row
+    samples — is POSTed, so an arbitrary URL would let a caller aim a blind
+    POST into the operator's network and exfiltrate the results. The target
+    must be a platform URL as the server's own environment sees it: a
+    per-request `entropy-data-host` header does not widen the set, or the
+    guard would be the caller's to configure.
+    """
+    from datacontract.integration.entropy_data import is_platform_url
+
+    if publish_url is None or is_platform_url(publish_url, None):
+        return
+    raise HTTPException(
+        status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+        detail=(
+            "The publish_url must point at the Entropy Data platform. To publish to a self-hosted "
+            "deployment, set the environment variable ENTROPY_DATA_HOST on the server running this "
+            "API to that host."
+        ),
+    )
+
+
+def _reject_request_platform_host_with_environment_key(config) -> None:
+    """Keep the environment-held platform API key from following a request-chosen host.
+
+    The platform host decides where the Entropy Data API key travels, and it can
+    be set per request (`entropy-data-host` header). A request that supplies the
+    host while the key resolves from the server's environment could therefore
+    aim that key at its own machine — same rule as the data sources: an
+    environment credential goes only to an environment-pinned destination. A
+    caller who brings the key itself may aim it wherever they like.
+    """
+    from datacontract.config import Config
+
+    resolved = Config.resolve(config)
+    key_source = next(
+        (source for field in _PLATFORM_KEY_FIELDS if (source := resolved.option_source(field)) is not None), None
+    )
+    if key_source != "env":
+        return
+    if not any(resolved.option_source(field) == "request" for field in _PLATFORM_HOST_FIELDS):
+        return
+    raise HTTPException(
+        status_code=status.HTTP_422_UNPROCESSABLE_ENTITY,
+        detail=(
+            "This server holds an Entropy Data API key in its environment, so the platform host must "
+            "also come from the server's environment (ENTROPY_DATA_HOST); it will not be taken from a "
+            "request header. Remove the entropy-data-host header, or send the API key with the request "
+            "instead of relying on the server's environment."
+        ),
+    )
+
+
 def check_api_key(api_key_header: str | None):
     correct_api_key = os.getenv("DATACONTRACT_CLI_API_KEY")
     if correct_api_key is None or correct_api_key == "":
@@ -457,7 +664,7 @@ def check_api_key(api_key_header: str | None):
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Missing API key. Use Header 'x-api-key' to provide the API key.",
         )
-    if api_key_header != correct_api_key:
+    if not secrets.compare_digest(api_key_header, correct_api_key):
         logging.info("The provided API key is not correct.")
         raise HTTPException(
             status_code=status.HTTP_403_FORBIDDEN,
@@ -500,8 +707,9 @@ handled. A contract that cannot be parsed is reported the same way, as a failed
             },
         },
         422: {
-            "description": "`filter` and `filters` were both given, or `filters` is not a JSON object "
-            "mapping schema name to a SQL predicate.",
+            "description": "`filter` and `filters` were both given, `filters` is not a JSON object "
+            "mapping schema name to a SQL predicate, or `publish_url` does not point at the Entropy "
+            "Data platform or the host configured via `ENTROPY_DATA_HOST`.",
             "model": UnprocessableEntityResponse,
         },
     },
@@ -529,7 +737,9 @@ async def test(
     publish_url: Annotated[
         str | None,
         Query(
-            description="URL to publish test results. Optional, if you want to publish the test results to a Data Mesh Manager or Data Contract Manager. Example: https://api.datamesh-manager.com/api/test-results",
+            description="URL to publish test results. Optional, if you want to publish the test results to a Data Mesh Manager or Data Contract Manager. Example: https://api.datamesh-manager.com/api/test-results. "
+            "Must point at the Entropy Data platform, or at the host configured on this server "
+            "via the environment variable ENTROPY_DATA_HOST — other hosts are refused with 422.",
             examples=["https://api.datamesh-manager.com/api/test-results"],
         ),
     ] = None,
@@ -560,14 +770,22 @@ async def test(
         )
     logging.info("Testing data contract...")
     logging.info(body)
+    config = config_from_headers(request.headers)
+    untrusted_contract = getattr(request.app.state, "untrusted_contracts", False)
+    if untrusted_contract:
+        _reject_unpinned_publish_url(publish_url)
+        _reject_request_platform_host_with_environment_key(config)
+        _reject_environment_credentials_to_untrusted_host(body, server, config)
+        _reject_local_server_type(body, server, config)
     return DataContract(
         data_contract_str=body,
         server=server,
         publish_url=publish_url,
         fastapi_url=str(request.url),
-        config=config_from_headers(request.headers),
+        config=config,
         filter=filter,
         filters=parsed_filters,
+        untrusted_contract=untrusted_contract,
     ).test()
 
 
@@ -705,6 +923,11 @@ async def changelog_endpoint(
         raise HTTPException(status_code=422, detail=f"Invalid YAML: {e}")
     except pydantic.ValidationError as e:
         raise HTTPException(status_code=422, detail=f"Invalid data contract: {e}")
+    except DefinitionResolutionError as e:
+        # The reason names the host that was contacted and what it answered.
+        # Omit for security reasons.
+        logging.warning("Definition resolution failed: %s", e)
+        raise HTTPException(status_code=422, detail=f"Could not resolve authoritative definition '{e.url}'.")
     except DataContractException as e:
         raise HTTPException(status_code=422, detail=f"Data Contract Validation Failure: {e}")
     finally:
@@ -823,5 +1046,10 @@ def export(
         raise HTTPException(status_code=422, detail=f"Invalid YAML: {e}")
     except pydantic.ValidationError as e:
         raise HTTPException(status_code=422, detail=f"Invalid data contract: {e}")
+    except DefinitionResolutionError as e:
+        # The reason names the host that was contacted and what it answered.
+        # Omit for security reasons.
+        logging.warning("Definition resolution failed: %s", e)
+        raise HTTPException(status_code=422, detail=f"Could not resolve authoritative definition '{e.url}'.")
     except DataContractException as e:
         raise HTTPException(status_code=422, detail=f"Data Contract Validation Failure: {e}")

{datacontract_cli-1.1.1 → datacontract_cli-1.1.2}/datacontract/catalog/catalog.py

@@ -123,7 +123,7 @@ def create_index_html(contracts, path):
         env = Environment(
             loader=package_loader,
             autoescape=select_autoescape(
-                enabled_extensions="html",
+                enabled_extensions=("html", "htm", "xml"),
                 default_for_string=True,
             ),
         )

{datacontract_cli-1.1.1 → datacontract_cli-1.1.2}/datacontract/cli.py

@@ -245,6 +245,17 @@ def _print_logs(run, out=None):
         out.print(log.timestamp.strftime("%y-%m-%d %H:%M:%S"), log.level.ljust(5), log.message)
 
 
+def _print_publish_failure(run, out=None):
+    """Surface the publish log messages on the console; logging is suppressed without --debug."""
+    if out is None:
+        out = console
+    for log in run.logs:
+        if log.level in ("WARN", "ERROR") and "publish" in log.message.lower():
+            color = "red" if log.level == "ERROR" else "yellow"
+            # highlight=False: render as prose, not rich's code-like repr highlighting.
+            out.print(f"[{color}]{escape(log.message)}[/{color}]", highlight=False)
+
+
 # ---------------------------------------------------------------------------
 # Register commands (must be after app and shared helpers are defined so the
 # command_* modules can import from this module without circular-import issues)

{datacontract_cli-1.1.1 → datacontract_cli-1.1.2}/datacontract/command_api.py

@@ -4,7 +4,7 @@ from typing_extensions import Annotated
 from datacontract.cli import app, debug_option, enable_debug_logging
 
 
-def _get_uvicorn_arguments(port: int, host: str, context: typer.Context) -> dict:
+def _get_uvicorn_arguments(port: int, host: str, reload: bool, context: typer.Context) -> dict:
     """
     Take the default datacontract uvicorn arguments and merge them with the
     extra arguments passed to the command to start the API.
@@ -13,7 +13,7 @@ def _get_uvicorn_arguments(port: int, host: str, context: typer.Context) -> dict
         "app": "datacontract.api:app",
         "port": port,
         "host": host,
-        "reload": True,
+        "reload": reload,
     }
 
     # Create a list of the extra arguments, remove the leading -- from the cli arguments
@@ -33,6 +33,13 @@ def api(
     host: Annotated[
         str, typer.Option(help="Bind socket to this host. Hint: For running in docker, set it to 0.0.0.0")
     ] = "127.0.0.1",
+    reload: Annotated[
+        bool,
+        typer.Option(
+            "--reload/--no-reload",
+            help="Watch the source files and restart the server on changes. For development only; off by default.",
+        ),
+    ] = False,
     debug: debug_option = None,
 ):
     """
@@ -59,7 +66,7 @@ def api(
     log_config = LOGGING_CONFIG
     log_config["root"] = {"level": "INFO"}
 
-    uvicorn_args = _get_uvicorn_arguments(port, host, ctx)
+    uvicorn_args = _get_uvicorn_arguments(port, host, reload, ctx)
     # Add the log config
     uvicorn_args["log_config"] = log_config
     # Run uvicorn

{datacontract_cli-1.1.1 → datacontract_cli-1.1.2}/datacontract/command_ci.py

@@ -8,6 +8,7 @@ from typing_extensions import Annotated
 
 from datacontract.cli import (
     _print_logs,
+    _print_publish_failure,
     app,
     console,
     debug_option,
@@ -136,6 +137,10 @@ def ci(
             write_test_result(run, out, output_format, output)
         except typer.Exit:
             pass
+        if run.publish_succeeded is False:
+            # A publish that was asked for and failed is a failed run, regardless of --fail-on.
+            _print_publish_failure(run, out)
+            should_fail = True
         if run.result in fail_results[fail_on]:
             should_fail = True
 

{datacontract_cli-1.1.1 → datacontract_cli-1.1.2}/datacontract/command_dbt.py

@@ -172,10 +172,11 @@ def _count(n: int, noun: str) -> str:
 _MAX_LISTED_FILES = 5
 
 
-def _print_sync_summary(gen, project_dir: Path, *, debug: bool = False) -> None:
+def _print_sync_summary(gen, project_dir: Path, *, debug: bool = False, dry_run: bool = False) -> None:
     """Print the per-contract sync summary, naming the touched files."""
     prefix = f"{gen.contract_path.name}: "
-    line = f"{prefix}Synced {_count(len(gen.resolved_models), 'model')}: updated {_count(len(gen.written_yaml), 'YAML file')}"
+    verb = "Would sync" if dry_run else "Synced"
+    line = f"{prefix}{verb} {_count(len(gen.resolved_models), 'model')}: updated {_count(len(gen.written_yaml), 'YAML file')}"
     if gen.written_sql:
         line += f", wrote {_count(len(gen.written_sql), 'singular SQL test')}"
     if gen.deleted_files:
@@ -315,6 +316,12 @@ def sync_command(
         bool,
         typer.Option(help="Remove model columns and tags that are not declared in the contract."),
     ] = False,
+    dry_run: Annotated[
+        bool,
+        typer.Option(
+            "--dry-run/--no-dry-run", help="Run in dry-run mode, without applying any changes to the dbt project."
+        ),
+    ] = False,
     run_tests_flag: Annotated[
         bool,
         typer.Option(
@@ -336,7 +343,8 @@ def sync_command(
     Generate dbt tests and model metadata from one or more ODCS contracts.
 
     Modifies the existing dbt model YAML in place (preserving comments and formatting), and creates new model YAML files
-    or singular SQL tests if needed. Use `datacontract dbt test` or pass --run-tests to run the generated tests.
+    or singular SQL tests if needed (if not run in dry-run mode). Use `datacontract dbt test` or pass --run-tests to run
+    the generated tests.
     """
     enable_debug_logging(debug)
     validate_publish_url(publish)
@@ -390,6 +398,7 @@ def sync_command(
                 prune=prune,
                 model_version=dbt_version,
                 server=server,
+                dry_run=dry_run,
             )
         except Exception as e:
             if not multiple_contracts:
@@ -398,7 +407,7 @@ def sync_command(
             continue
         if not contract and not multiple_contracts:
             console.print(f"Resolved contract {gen.contract_path}")
-        _print_sync_summary(gen, project_dir, debug=bool(debug))
+        _print_sync_summary(gen, project_dir, debug=bool(debug), dry_run=dry_run)
         if not prune:
             _warn_prunable(gen, project_dir)
         ctxs.append(_ContractCtx(gen.contract_path, gen.odcs, gen.resolved_models, gen.generation_run, dbt_version))

{datacontract_cli-1.1.1 → datacontract_cli-1.1.2}/datacontract/command_test.py

@@ -7,6 +7,7 @@ from typing_extensions import Annotated
 
 from datacontract.cli import (
     _print_logs,
+    _print_publish_failure,
     app,
     console,
     debug_option,
@@ -290,4 +291,11 @@ def test(
         data_contract = resolve_data_contract(location, schema_location=schema, config=cli_config())
     except Exception:
         data_contract = None
-    write_test_result(run, console, output_format, output, data_contract)
+    try:
+        write_test_result(run, console, output_format, output, data_contract)
+    finally:
+        # Publish messages are otherwise only logged, which is suppressed without --debug.
+        if run.publish_succeeded is False:
+            _print_publish_failure(run)
+    if run.publish_succeeded is False:
+        raise typer.Exit(code=1)

{datacontract_cli-1.1.1 → datacontract_cli-1.1.2}/datacontract/config/settings.py

@@ -38,6 +38,8 @@ SERVER_OVERRIDE_OPTIONS = {
     "databricks_server_hostname": "host",
     "databricks_catalog": "catalog",
     "databricks_schema": "schema",
+    "duckdb_database": "database",
+    "duckdb_schema": "schema",
     "impala_host": "host",
     "impala_port": "port",
     "impala_database": "database",
@@ -130,6 +132,11 @@ class Config(BaseSettings):
     databricks_catalog: str | None = None
     databricks_schema: str | None = None
 
+    # duckdb
+    # overrides for the contract's servers block
+    duckdb_database: str | None = None
+    duckdb_schema: str | None = None
+
     # gcs
     gcs_key_id: str | None = None
     gcs_secret: SecretStr | None = None
@@ -348,6 +355,21 @@ class Config(BaseSettings):
             value = value.get_secret_value()
         return value
 
+    def option_source(self, field_name: str) -> str | None:
+        """Where ``get_<field_name>()`` takes its value from.
+
+        ``"request"`` when the value is set on this Config (a per-request header,
+        a config file, or a programmatic value), ``"env"`` when it falls back to
+        the process environment, and ``None`` when it is unset everywhere. Used to
+        keep a credential the server holds in its environment from being sent to a
+        host chosen by an untrusted caller.
+        """
+        if getattr(self, field_name) is not None:
+            return "request"
+        if os.environ.get(env_name(field_name, type(self).model_fields[field_name])) is not None:
+            return "env"
+        return None
+
     def _str_option(self, field_name: str, required: bool = False) -> str | None:
         value = self._raw_option(field_name)
         value = str(value) if value is not None else None
@@ -361,7 +383,7 @@ class Config(BaseSettings):
                 name=f"missing_env_{key}",
                 reason=f"Required configuration {key} is not set. Set the environment variable "
                 f"or pass it via DataContract(config=...) to connect to {server_type}.",
-                engine="datacontract",
+                engine="datacontract-cli",
             )
         return value
 
@@ -395,7 +417,7 @@ class Config(BaseSettings):
                 type="configuration",
                 name=f"invalid_{key}",
                 reason=f"{key} must be a whole number, got {value!r}.",
-                engine="datacontract",
+                engine="datacontract-cli",
             )
 
     def _bool_option(self, field_name: str, default: bool) -> bool:
@@ -608,6 +630,12 @@ class Config(BaseSettings):
     def get_postgres_password(self, required: bool = False) -> str | None:
         return self._str_option("postgres_password", required)
 
+    def get_duckdb_database(self, required: bool = False) -> str | None:
+        return self._str_option("duckdb_database", required)
+
+    def get_duckdb_schema(self, required: bool = False) -> str | None:
+        return self._str_option("duckdb_schema", required)
+
     def get_postgres_host(self, required: bool = False) -> str | None:
         return self._str_option("postgres_host", required)