dbt-costgate 0.7.1__tar.gz

dbt_costgate-0.7.1/.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 2
+
+[*.py]
+indent_size = 4
+
+[*.md]
+trim_trailing_whitespace = false
+
+[Makefile]
+indent_style = tab

dbt_costgate-0.7.1/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,39 @@
+name: Bug report
+description: A cost estimate is wrong, the gate misbehaves, or something does not work as documented.
+labels: ["bug", "triage"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for filing a report. For a **security** issue, do not use this
+        form — see [SECURITY.md](../security/policy) and report privately.
+  - type: input
+    id: version
+    attributes:
+      label: Version and environment
+      description: dbt-costgate version, dbt / dbt-bigquery versions, Python version, and where it ran.
+      placeholder: "dbt-costgate 0.1.0, dbt-core 1.9.x, dbt-bigquery 1.9.x, Python 3.12, GitHub Actions"
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+      description: What should dbt-costgate have reported or done? If a dollar/bytes figure is wrong, what does the BigQuery console's own dry-run estimate say for the same SQL?
+    validations:
+      required: true
+  - type: textarea
+    id: actual
+    attributes:
+      label: Actual behavior
+      description: What did it report or do? Paste the report output — **redact model names, dataset names, or figures you consider sensitive.**
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Reproduction
+      description: Minimal steps or command to reproduce. Do not include credentials or compiled SQL containing secrets.
+      render: shell
+    validations:
+      required: false

dbt_costgate-0.7.1/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,8 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Security vulnerability
+    url: https://github.com/Drichards124/dbt-costgate/security/advisories/new
+    about: Report security issues privately via GitHub's private vulnerability reporting — not as a public issue.
+  - name: Question or discussion
+    url: https://github.com/Drichards124/dbt-costgate/discussions
+    about: Ask usage questions or discuss ideas before filing a feature request.

dbt_costgate-0.7.1/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,31 @@
+name: Feature request
+description: Propose an improvement to the gate, the report, or the pricing model.
+labels: ["enhancement", "triage"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What cost-visibility problem are you hitting that dbt-costgate doesn't solve today?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: What would you like dbt-costgate to do? If it affects reported dollars, say how the figure should be derived.
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+      description: Workarounds you use today, or other tools that partially cover this.
+    validations:
+      required: false
+  - type: markdown
+    attributes:
+      value: |
+        Note the project's hard invariants (see CONTRIBUTING.md): dry-run only,
+        no credential handling, no telemetry. Proposals that require breaking
+        one of these will be redirected to a design discussion.

dbt_costgate-0.7.1/.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,29 @@
+<!--
+  Pull requests target the `ple` branch, not `main`. See CONTRIBUTING.md.
+-->
+
+## What and why
+
+<!-- What does this change do, and what problem does it solve? -->
+
+## Related issues
+
+<!-- e.g. Closes #12 -->
+
+## Cost-safety invariants
+
+If this touches warehouse interaction, pricing, or reporting, confirm:
+
+- [ ] The only query type issued is a BigQuery **dry-run** (`dryRun=true`) — nothing billable, no table data read.
+- [ ] No credential handling was added; auth still delegates entirely to Application Default Credentials.
+- [ ] Reports still exclude compiled SQL by default (secrets can be templated into SQL).
+- [ ] Pricing table changes cite Google's published pricing page and update `last_verified`.
+
+## Checklist
+
+- [ ] Targets the `ple` branch.
+- [ ] All commits are signed off for the DCO (`git commit -s`).
+- [ ] Every new source file has the SPDX header (`SPDX-License-Identifier: Apache-2.0`).
+- [ ] Tests pass locally (`python -m pytest -q`).
+- [ ] Lint passes (`ruff check . && ruff format --check .`).
+- [ ] `CHANGELOG.md` updated under `## [Unreleased]` if this is user-visible.

dbt_costgate-0.7.1/.github/dependabot.yml

@@ -0,0 +1,19 @@
+version: 2
+updates:
+  # Runtime dependencies are deliberately minimal (see SECURITY.md — this tool
+  # runs next to warehouse credentials). Updates target `ple` so they pass the
+  # production-like gate before reaching `main`, like any change.
+  - package-ecosystem: "pip"
+    directory: "/"
+    target-branch: "ple"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels: ["dependencies"]
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    target-branch: "ple"
+    schedule:
+      interval: "weekly"
+    labels: ["dependencies", "ci"]

dbt_costgate-0.7.1/.github/selftest/dbt-costgate

@@ -0,0 +1,23 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+#
+# Test double for the dbt-costgate CLI — used ONLY by action-selftest.yml to exercise
+# action.yml's orchestration without BigQuery. Writes a canned markdown report to
+# --output and exits with $SHIM_EXIT (default 0). On exit 2 it writes NOTHING,
+# reproducing dbt-costgate's real "no report on operational error" behavior so the
+# action's synthesized-body path is exercised.
+out=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --output)
+      shift
+      out="$1"
+      ;;
+  esac
+  shift
+done
+code="${SHIM_EXIT:-0}"
+if [ "$code" != "2" ] && [ -n "$out" ]; then
+  printf '### 💸 dbt-costgate — cost impact of this change\n\n_self-test report_\n' >"$out"
+fi
+exit "$code"

dbt_costgate-0.7.1/.github/selftest/gh

@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: Apache-2.0
+#
+# Test double for the gh CLI — used ONLY by action-selftest.yml. The list call
+# (recognised by --jq) prints $FAKE_GH_IDS; a POST/PATCH appends one tab-separated
+# line (method, URL, whether the body carried the sticky marker) to $FAKE_GH_LOG.
+# No network, no token.
+method=""
+url=""
+body=""
+is_list=0
+args=("$@")
+i=0
+while [ $i -lt ${#args[@]} ]; do
+  a="${args[$i]}"
+  case "$a" in
+    --jq) is_list=1 ;;
+    --method)
+      i=$((i + 1))
+      method="${args[$i]}"
+      ;;
+    -F)
+      i=$((i + 1))
+      f="${args[$i]}"
+      case "$f" in body=@*) body="${f#body=@}" ;; esac
+      ;;
+    repos/*) url="$a" ;;
+  esac
+  i=$((i + 1))
+done
+if [ "$is_list" = "1" ]; then
+  [ -n "${FAKE_GH_IDS:-}" ] && printf '%s\n' "$FAKE_GH_IDS"
+  exit 0
+fi
+marker=no
+if [ -n "$body" ] && [ -f "$body" ]; then
+  grep -qF '<!-- dbt-costgate-sticky -->' "$body" && marker=yes
+fi
+printf '%s\t%s\tmarker=%s\n' "$method" "$url" "$marker" >>"${FAKE_GH_LOG:-/dev/null}"
+exit 0

dbt_costgate-0.7.1/.github/workflows/action-selftest.yml

@@ -0,0 +1,124 @@
+# SPDX-License-Identifier: Apache-2.0
+name: Action self-test
+
+# Exercises action.yml end to end without BigQuery or the real GitHub API: a
+# shimmed `dbt-costgate` drives each exit code (writing no report on exit 2, as the
+# real CLI does) and a shimmed `gh` records the comment calls. Verifies the parts
+# unit tests can't reach — input plumbing, exit-code propagation, and the
+# synthesized-body path — while tests/test_sticky_comment.py covers the upsert.
+on:
+  pull_request:
+    branches: [ple, main]
+    paths:
+      - action.yml
+      - scripts/**
+      - .github/selftest/**
+      - .github/workflows/action-selftest.yml
+  push:
+    branches-ignore: [main, ple]
+    paths:
+      - action.yml
+      - scripts/**
+      - .github/selftest/**
+      - .github/workflows/action-selftest.yml
+
+permissions:
+  contents: read
+
+concurrency:
+  group: action-selftest-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  selftest:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Put the test doubles ahead of everything on PATH
+        run: |
+          chmod +x "$GITHUB_WORKSPACE/.github/selftest/dbt-costgate" "$GITHUB_WORKSPACE/.github/selftest/gh"
+          echo "$GITHUB_WORKSPACE/.github/selftest" >>"$GITHUB_PATH"
+
+      # --- Case A: pass, no existing sticky → POST, step succeeds ---
+      - name: Case A — pass
+        id: case_a
+        uses: ./
+        env:
+          SHIM_EXIT: "0"
+          FAKE_GH_IDS: ""
+          FAKE_GH_LOG: ${{ runner.temp }}/a.log
+        with:
+          comment: "true"
+      - name: Assert A outputs
+        run: |
+          [ "${{ steps.case_a.outputs.status }}" = "ok" ] || { echo "A: status != ok"; exit 1; }
+          [ "${{ steps.case_a.outputs.exit-code }}" = "0" ] || { echo "A: exit-code != 0"; exit 1; }
+      - name: Assert A comment
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
+        run: |
+          grep -qE '^POST[[:space:]].*marker=yes' "${{ runner.temp }}/a.log" \
+            || { echo "A: expected a POST carrying the marker"; cat "${{ runner.temp }}/a.log" 2>/dev/null; exit 1; }
+
+      # --- Case B: gate failed (exit 1), existing sticky → PATCH, step fails ---
+      - name: Case B — gate fail
+        id: case_b
+        continue-on-error: true
+        uses: ./
+        env:
+          SHIM_EXIT: "1"
+          FAKE_GH_IDS: "777"
+          FAKE_GH_LOG: ${{ runner.temp }}/b.log
+        with:
+          comment: "true"
+      - name: Assert B outputs
+        run: |
+          [ "${{ steps.case_b.outcome }}" = "failure" ] || { echo "B: expected step failure"; exit 1; }
+          [ "${{ steps.case_b.outputs.status }}" = "failed" ] || { echo "B: status != failed"; exit 1; }
+          [ "${{ steps.case_b.outputs.exit-code }}" = "1" ] || { echo "B: exit-code != 1"; exit 1; }
+      - name: Assert B comment
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
+        run: |
+          grep -qE '^PATCH[[:space:]]repos/.*/issues/comments/777' "${{ runner.temp }}/b.log" \
+            || { echo "B: expected a PATCH of comment 777"; cat "${{ runner.temp }}/b.log" 2>/dev/null; exit 1; }
+
+      # --- Case C: operational (exit 2), alert-only → synthesized body, step passes ---
+      - name: Case C — operational, alert-only
+        id: case_c
+        uses: ./
+        env:
+          SHIM_EXIT: "2"
+          FAKE_GH_IDS: ""
+          FAKE_GH_LOG: ${{ runner.temp }}/c.log
+        with:
+          comment: "true"
+          fail-on-operational: "false"
+      - name: Assert C outputs
+        run: |
+          [ "${{ steps.case_c.outcome }}" = "success" ] || { echo "C: expected step success (alert-only)"; exit 1; }
+          [ "${{ steps.case_c.outputs.status }}" = "error" ] || { echo "C: status != error"; exit 1; }
+          [ "${{ steps.case_c.outputs.exit-code }}" = "2" ] || { echo "C: exit-code != 2"; exit 1; }
+      - name: Assert C comment
+        if: github.event_name == 'pull_request' && github.event.pull_request.head.repo.fork == false
+        run: |
+          grep -qE '^POST[[:space:]].*marker=yes' "${{ runner.temp }}/c.log" \
+            || { echo "C: expected a synthesized POST carrying the marker"; cat "${{ runner.temp }}/c.log" 2>/dev/null; exit 1; }
+
+      # --- Case D: operational (exit 2), fail-on-operational → step fails ---
+      - name: Case D — operational, hard-fail
+        id: case_d
+        continue-on-error: true
+        uses: ./
+        env:
+          SHIM_EXIT: "2"
+          FAKE_GH_LOG: ${{ runner.temp }}/d.log
+        with:
+          comment: "false"
+          fail-on-operational: "true"
+      - name: Assert D outputs
+        run: |
+          [ "${{ steps.case_d.outcome }}" = "failure" ] || { echo "D: expected step failure"; exit 1; }
+          [ "${{ steps.case_d.outputs.exit-code }}" = "2" ] || { echo "D: exit-code != 2"; exit 1; }

dbt_costgate-0.7.1/.github/workflows/ci.yml

@@ -0,0 +1,49 @@
+# SPDX-License-Identifier: Apache-2.0
+name: CI
+
+# Fast feedback on every pull request and every feature-branch push. The heavier
+# production-like matrix runs separately once a change lands on `ple` (ple.yml).
+on:
+  pull_request:
+    branches: [ple, main]
+  push:
+    branches-ignore: [main, ple]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  python:
+    name: Python (${{ matrix.python }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.9", "3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+      - run: python -m pip install -e ".[dev]"
+      - run: ruff check .
+      - run: ruff format --check .
+      - run: python -m pytest -q
+
+  ci-gate:
+    name: CI gate
+    runs-on: ubuntu-latest
+    needs: [python]
+    if: always()
+    steps:
+      - name: Require all CI jobs to have succeeded
+        run: |
+          if [ "${{ needs.python.result }}" != "success" ]; then
+            echo "One or more CI jobs did not succeed."
+            exit 1
+          fi
+          echo "All CI checks passed."

dbt_costgate-0.7.1/.github/workflows/ple.yml

@@ -0,0 +1,70 @@
+# SPDX-License-Identifier: Apache-2.0
+name: PLE
+
+# Production-Like-Environment gate. Everything merges to `ple` before `main`.
+# This proves the change on the full OS/runtime matrix AND against the
+# actually-packaged artifact (install the built wheel fresh, then run it) —
+# not just against the source tree. A green PLE run is the precondition for
+# promoting `ple` to `main` and cutting a release.
+on:
+  push:
+    branches: [ple]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ple-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  py-matrix:
+    name: Tests (${{ matrix.os }} / ${{ matrix.python }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+        python: ["3.9", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python }}
+      - run: python -m pip install -e ".[dev]"
+      - run: ruff check .
+      - run: python -m pytest -q
+
+  packaged-artifact-smoke:
+    name: Packaged-artifact smoke test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Build wheel and sdist
+        run: |
+          python -m pip install build
+          python -m build
+      - name: Install the built wheel into a clean environment and run it
+        run: |
+          python -m venv /tmp/smoke
+          /tmp/smoke/bin/pip install dist/*.whl
+          /tmp/smoke/bin/dbt-costgate --version
+          /tmp/smoke/bin/python -c "import dbt_costgate; print(dbt_costgate.__version__)"
+
+  ple-gate:
+    name: PLE gate
+    runs-on: ubuntu-latest
+    needs: [py-matrix, packaged-artifact-smoke]
+    if: always()
+    steps:
+      - name: Require all PLE jobs to have succeeded
+        run: |
+          if [ "${{ needs.py-matrix.result }}" != "success" ] || [ "${{ needs.packaged-artifact-smoke.result }}" != "success" ]; then
+            echo "One or more PLE jobs did not succeed."
+            exit 1
+          fi
+          echo "PLE matrix green — safe to promote ple to main."

dbt_costgate-0.7.1/.github/workflows/release.yml

@@ -0,0 +1,108 @@
+# SPDX-License-Identifier: Apache-2.0
+name: Release
+
+# Cut a GitHub Release when a vX.Y.Z tag is pushed to main. Builds the wheel and
+# sdist, checksums them, smoke-tests the built wheel, and publishes a Release with
+# those artifacts and the CHANGELOG section for the version. No PyPI publish.
+on:
+  push:
+    tags: ["v[0-9]+.[0-9]+.[0-9]+"]
+
+permissions:
+  contents: write # only to create the GitHub Release
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Verify tag matches package version
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          pkg="$(python -c "import re, pathlib; print(re.search(r'__version__ = \"([^\"]+)\"', pathlib.Path('src/dbt_costgate/__init__.py').read_text()).group(1))")"
+          if [ "$version" != "$pkg" ]; then
+            echo "Tag $GITHUB_REF_NAME (version $version) does not match package version $pkg."
+            exit 1
+          fi
+          echo "Tag matches package version $pkg."
+
+      - name: Build wheel and sdist
+        run: |
+          python -m pip install build
+          python -m build
+
+      - name: Checksum the artifacts
+        run: |
+          ( cd dist && sha256sum *.whl *.tar.gz > SHA256SUMS )
+          cat dist/SHA256SUMS
+
+      - name: Install the built wheel into a clean environment and verify it
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          python -m venv /tmp/smoke
+          /tmp/smoke/bin/pip install dist/*.whl
+          /tmp/smoke/bin/dbt-costgate --version
+          got="$(/tmp/smoke/bin/python -c "import dbt_costgate; print(dbt_costgate.__version__)")"
+          if [ "$got" != "$version" ]; then
+            echo "Installed wheel reports version $got, expected $version."
+            exit 1
+          fi
+
+      - name: Extract release notes from CHANGELOG
+        run: |
+          version="${GITHUB_REF_NAME#v}"
+          awk -v ver="$version" '
+            index($0, "## [" ver "]") == 1 { flag=1; next }
+            /^## \[/ { flag=0 }
+            flag { print }
+          ' CHANGELOG.md > RELEASE_NOTES.md
+          [ -s RELEASE_NOTES.md ] || { echo "no CHANGELOG section for $version"; exit 1; }
+          cat RELEASE_NOTES.md
+
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "$GITHUB_REF_NAME" dist/* \
+            --title "dbt-costgate $GITHUB_REF_NAME" \
+            --notes-file RELEASE_NOTES.md
+
+      # Hand the distributions to the publish job. SHA256SUMS is deliberately not
+      # included: PyPI rejects anything in the upload directory that isn't a
+      # distribution, and it belongs to the GitHub Release, not to PyPI.
+      - name: Upload distributions for the PyPI job
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: |
+            dist/*.whl
+            dist/*.tar.gz
+          if-no-files-found: error
+
+  # Publishing runs only after the GitHub Release exists, so a PyPI outage leaves
+  # a complete, downloadable release behind rather than nothing at all.
+  pypi:
+    name: Publish to PyPI
+    needs: release
+    runs-on: ubuntu-latest
+    environment: pypi
+    # Trusted publishing (OIDC): GitHub mints a short-lived identity token that
+    # PyPI verifies against the registered publisher. There is no API token to
+    # store, rotate, or leak. Declared here rather than at the top of the file so
+    # only this job can request it — and note that a job-level block replaces the
+    # workflow default, so this job deliberately has no `contents: write`.
+    permissions:
+      id-token: write
+    steps:
+      - name: Download the distributions built above
+        uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

dbt_costgate-0.7.1/.gitignore

@@ -0,0 +1,31 @@
+# --- General ---
+.DS_Store
+*.log
+.env
+.env.*
+!.env.example
+
+# --- Python ---
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.venv/
+venv/
+dist/
+build/
+*.egg-info/
+coverage/
+.coverage
+
+# --- Editors ---
+.idea/
+.vscode/
+*.swp
+
+# --- Local working notes (private; not released) ---
+# Decision records are personal reasoning that feeds docs/architecture.md.
+# Only architecture.md and its upgrades ship publicly.
+docs/decisions/
+CLAUDE.local.md