dbt-dqm 0.2.0__tar.gz

dbt_dqm-0.2.0/.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,28 @@
+name: Bug report
+description: Report incorrect collection, lifecycle, adapter, or app behavior
+body:
+  - type: textarea
+    id: behavior
+    attributes:
+      label: Observed behavior
+    validations:
+      required: true
+  - type: textarea
+    id: reproduction
+    attributes:
+      label: Minimal reproduction
+    validations:
+      required: true
+  - type: input
+    id: versions
+    attributes:
+      label: dbt-dqm, dbt, adapter, warehouse, and Python versions
+    validations:
+      required: true
+  - type: checkboxes
+    id: safety
+    attributes:
+      label: Data safety
+      options:
+        - label: I removed credentials, customer data, and complete failed-row contents.
+          required: true

dbt_dqm-0.2.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,19 @@
+name: Feature request
+description: Propose a focused open-source improvement
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: User problem
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed behavior
+    validations:
+      required: true
+  - type: textarea
+    id: adapters
+    attributes:
+      label: Adapter and compatibility implications

dbt_dqm-0.2.0/.github/dependabot.yml

@@ -0,0 +1,32 @@
+version: 2
+updates:
+  # Read uv.lock so version-type exclusions also cover range-only requirements.
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    # Deferred compatibility work: https://github.com/a-adamovich/dbt-dqm/issues/11
+    # Update-type exclusions preserve patch updates and security-update handling.
+    ignore:
+      # dbt minors are adopted deliberately: the protocol SQL must render identically and the full
+      # warehouse suites must pass before the pins and require-dbt-version move (see #11).
+      - dependency-name: dbt-core
+        update-types: ["version-update:semver-minor"]
+      - dependency-name: dbt-bigquery
+        update-types: ["version-update:semver-minor"]
+      - dependency-name: dbt-postgres
+        update-types: ["version-update:semver-minor"]
+      - dependency-name: pandas
+        update-types: ["version-update:semver-major"]
+      # pyarrow majors are adopted deliberately, with the app memory benchmark rerun at the
+      # 50k cache boundary (pinned to 25.x; see #11 and docs/scale.md).
+      - dependency-name: pyarrow
+        update-types: ["version-update:semver-major"]
+    groups:
+      python-minor-patches:
+        patterns: ["*"]
+        update-types: [minor, patch]
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

dbt_dqm-0.2.0/.github/pull_request_template.md

@@ -0,0 +1,13 @@
+## Summary
+
+Describe the focused change and its user-visible behavior.
+
+## Verification
+
+- [ ] `ruff check .`
+- [ ] `pytest -q`
+- [ ] Relevant dbt adapter/demo lifecycle checks
+- [ ] Documentation and changelog updated where needed
+- [ ] Commits include DCO sign-off (`git commit -s`)
+
+Do not include credentials, proprietary data, customer names, or complete failed-row contents.

dbt_dqm-0.2.0/.github/workflows/bigquery-scheduled.yml

@@ -0,0 +1,111 @@
+name: Scheduled BigQuery lifecycle
+
+# Weekly credentialed BigQuery verification. Keyless: GitHub's OIDC token is exchanged through
+# Workload Identity Federation for a short-lived token of a dedicated CI service account, so no
+# long-lived key is stored. Inert until the repository variables below are set.
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 6 * * 1"
+
+permissions:
+  contents: read
+  id-token: write
+  issues: write
+
+jobs:
+  lifecycle:
+    concurrency:
+      group: dbt-dqm-${{ vars.DBT_DQM_BIGQUERY_PROJECT }}-dbt_dqm_scheduled_ci
+      cancel-in-progress: false
+    if: vars.BIGQUERY_LIFECYCLE_ENABLED == 'true' && github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    env:
+      DBT_DQM_BIGQUERY_PROJECT: ${{ vars.DBT_DQM_BIGQUERY_PROJECT }}
+      DBT_DQM_BIGQUERY_TEST_PROJECT: ${{ vars.DBT_DQM_BIGQUERY_PROJECT }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Authenticate to Google Cloud (Workload Identity Federation)
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
+        with:
+          workload_identity_provider: ${{ vars.GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ vars.GCP_CI_SERVICE_ACCOUNT }}
+      - name: Install uv
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          python-version: "3.14"
+      - name: Install dependencies
+        run: uv sync --locked --all-groups --extra bigquery
+      - name: Write profile (Application Default Credentials from the step above)
+        run: |
+          mkdir -p ~/.dbt
+          cat > ~/.dbt/profiles.yml <<'PROFILES'
+          dbt_dqm_demo:
+            target: ci
+            outputs:
+              ci:
+                type: bigquery
+                method: oauth
+                project: "{{ env_var('DBT_DQM_BIGQUERY_PROJECT') }}"
+                dataset: dbt_dqm_scheduled_ci
+                location: US
+                threads: 4
+          PROFILES
+      - name: The CI identity cannot read the shared QA dataset
+        run: |
+          uv run python - <<'PY'
+          import os
+          from google.api_core.exceptions import Forbidden, NotFound
+          from google.cloud import bigquery
+          project = os.environ["DBT_DQM_BIGQUERY_PROJECT"]
+          try:
+              bigquery.Client(project=project).query(
+                  f"select 1 from `{project}.dbt_dqm_qa.dqm_install` limit 1").result()
+          except (Forbidden, NotFound):
+              print("As expected, the CI service account has no access to dbt_dqm_qa.")
+          else:
+              raise SystemExit("The CI service account can read dbt_dqm_qa; narrow its roles.")
+          PY
+      - name: Full credentialed lifecycle (dedicated dataset)
+        working-directory: integration_tests/demo_bigquery
+        run: |
+          set -e
+          uv run dbt deps
+          uv run dbt run-operation reset_demo_dqm
+          uv run dbt seed
+          for scenario in initial passed recurrence; do
+            uv run dbt run --select demo_records --vars "{demo_scenario: $scenario}"
+            uv run dbt-dqm run --vars "{demo_scenario: $scenario}"
+            uv run dbt test --select assert_scenario_outcomes --vars "{demo_scenario: $scenario, dqm_enabled: true}"
+          done
+      - name: Credentialed acceptance suite (parallel, disposable datasets)
+        shell: bash
+        run: |
+          mkdir -p acceptance-results
+          set -o pipefail
+          uv run pytest -q -rA -n 6 --dist load integration_tests/acceptance/test_bigquery.py \
+            --junitxml=acceptance-results/bigquery.xml 2>&1 | tee acceptance-results/bigquery.log
+      - name: Sweep stale acceptance datasets
+        if: always()
+        run: uv run python integration_tests/acceptance/bigquery_datasets.py --project "$DBT_DQM_BIGQUERY_PROJECT" --older-than-hours 6
+      - name: Upload results
+        if: always()
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: scheduled-bigquery-results
+          path: acceptance-results/
+          if-no-files-found: ignore
+      - name: Report failure in an issue
+        if: failure()
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          gh label create scheduled-bigquery --color B60205 --description "Scheduled BigQuery verification" 2>/dev/null || true
+          existing="$(gh issue list --label scheduled-bigquery --state open --json number --jq '.[0].number')"
+          if [ -n "$existing" ]; then
+            gh issue comment "$existing" --body "Scheduled BigQuery verification failed again: $RUN_URL"
+          else
+            gh issue create --label scheduled-bigquery --title "Scheduled BigQuery verification failed" \
+              --body "The weekly credentialed BigQuery run failed on \`main\`: $RUN_URL"
+          fi

dbt_dqm-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,267 @@
+name: CI
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  lint-and-test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          python-version: ${{ matrix.python }}
+
+      - name: Install dependencies
+        run: uv sync --locked --all-groups --all-extras
+      - name: Check dependency consistency
+        run: uv pip check
+
+      - name: Ruff
+        run: uv run ruff check .
+
+      - name: Pytest
+        run: uv run pytest -q
+
+      - name: Streamlit startup smoke test
+        run: |
+          mkdir -p /tmp/dbt-dqm-smoke-project /tmp/dbt-dqm-smoke-profiles
+          printf 'name: smoke\nprofile: smoke\n' > /tmp/dbt-dqm-smoke-project/dbt_project.yml
+          printf 'smoke:\n  outputs:\n    dev:\n      type: postgres\n      host: localhost\n      user: smoke\n      pass: smoke\n      dbname: smoke\n      schema: smoke\n' > /tmp/dbt-dqm-smoke-profiles/profiles.yml
+          timeout 20 uv run dbt-dqm app --project-dir /tmp/dbt-dqm-smoke-project --profiles-dir /tmp/dbt-dqm-smoke-profiles --target dev --port 8765 &
+          for attempt in 1 2 3 4 5 6 7 8 9 10; do
+            if curl --fail --silent http://127.0.0.1:8765/_stcore/health; then exit 0; fi
+            sleep 1
+          done
+          exit 1
+
+  # Validates the dbt package (models/, macros/) end to end against a real warehouse without
+  # needing any secrets: a Postgres service container plus the synthetic demo project. There is
+  # no equivalent BigQuery job here since that would require committing or configuring warehouse
+  # credentials as repo secrets; add one separately (e.g. gated on a repo secret's presence) if
+  # BigQuery-specific coverage in CI is wanted later.
+  package-smoke:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install uv
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Install dependencies
+        run: uv sync --locked --all-groups --all-extras
+      - name: Check dependency consistency
+        run: uv pip check
+      - name: Build wheel and source distribution
+        run: uv build
+      - name: Check distribution metadata
+        run: uvx --from twine twine check dist/*
+      - name: Verify base and optional-adapter wheel installations
+        run: |
+          wheel="$(pwd)/$(ls dist/*.whl)"
+          smoke="$(pwd)/scripts/check_optional_install.py"
+          for variant in base bigquery postgres both; do
+            environment="/tmp/dbt-dqm-wheel-${variant}"
+            requirement="$wheel"
+            case "$variant" in
+              bigquery|postgres) requirement="${wheel}[${variant}]" ;;
+              both) requirement="${wheel}[bigquery,postgres]" ;;
+            esac
+            uv venv "$environment" --python ${{ matrix.python }}
+            uv pip install --python "$environment/bin/python" "$requirement"
+            uv pip check --python "$environment/bin/python"
+            "$environment/bin/python" "$smoke" "$variant"
+          done
+      - name: Wheel carries the security floors (#24)
+        run: DBT_DQM_WHEEL="$(ls dist/*.whl)" uv run pytest -q tests/test_dependency_floors.py tests/test_python_compatibility.py
+      - name: Installing the wheel upgrades older vulnerable versions
+        run: |
+          wheel="$(pwd)/$(ls dist/*.whl)"
+          uv venv /tmp/dbt-dqm-old-deps --python ${{ matrix.python }}
+          uv pip install --python /tmp/dbt-dqm-old-deps/bin/python sqlparse==0.5.5 urllib3==2.7.0 oauthlib==3.3.1 mashumaro==3.14
+          cd /tmp
+          uv pip install --python /tmp/dbt-dqm-old-deps/bin/python "${wheel}[bigquery,postgres]"
+          uv pip check --python /tmp/dbt-dqm-old-deps/bin/python
+          /tmp/dbt-dqm-old-deps/bin/python - <<'PY'
+          from importlib.metadata import version
+          from packaging.version import Version
+          floors = {"sqlparse": "0.6.0", "urllib3": "2.8.0", "oauthlib": "4.0.0", "mashumaro": "3.17"}
+          installed = {name: version(name) for name in floors}
+          print(installed)
+          assert all(Version(installed[n]) >= Version(v) for n, v in floors.items()), installed
+          PY
+
+  dbt-postgres:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.11", "3.12", "3.13", "3.14"]
+        postgres: ["14", "16"]
+    services:
+      postgres:
+        image: postgres:${{ matrix.postgres }}
+        env:
+          POSTGRES_PASSWORD: dbtdqm
+          POSTGRES_DB: dbt_dqm_ci
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          python-version: ${{ matrix.python }}
+
+      - name: Install dependencies
+        run: uv sync --locked --all-groups --extra postgres
+      - name: Check dependency consistency
+        run: uv pip check
+
+      - name: Enable pgcrypto
+        run: psql -h localhost -U postgres -d dbt_dqm_ci -c "create extension if not exists pgcrypto;"
+        env:
+          PGPASSWORD: dbtdqm
+
+      - name: Write profiles.yml
+        run: |
+          mkdir -p ~/.dbt
+          cat > ~/.dbt/profiles.yml <<'PROFILES'
+          dbt_dqm_demo_postgres:
+            target: ci
+            outputs:
+              ci:
+                type: postgres
+                host: localhost
+                port: 5432
+                user: postgres
+                pass: dbtdqm
+                dbname: dbt_dqm_ci
+                schema: dbt_dqm_demo
+                threads: 4
+          PROFILES
+
+      - name: dbt deps
+        working-directory: integration_tests/demo_postgres
+        run: uv run dbt deps
+
+      - name: Full lifecycle walkthrough (initial -> passed -> recurrence)
+        working-directory: integration_tests/demo_postgres
+        run: |
+          set -e
+          uv run dbt run-operation reset_demo_dqm
+          uv run dbt seed
+          for scenario in initial passed recurrence; do
+            uv run dbt run --select demo_records --vars "{demo_scenario: $scenario}"
+            uv run dbt-dqm run --vars "{demo_scenario: $scenario}"
+            uv run dbt test --select assert_scenario_outcomes --vars "{demo_scenario: $scenario, dqm_enabled: true}"
+          done
+
+      - name: Disabled commands and dedicated-workflow acceptance
+        working-directory: integration_tests/demo_postgres
+        run: |
+          uv run dbt parse
+          uv run dbt ls --select package:dbt_dqm --resource-type model --output name
+          uv run dbt run-operation assert_postgres_query_plans --vars '{dqm_enabled: true}'
+
+      - name: Transactional acceptance and application interfaces
+        shell: bash
+        run: |
+          set -o pipefail
+          mkdir -p acceptance-results
+          uv run pytest -q -rA integration_tests/acceptance/test_postgres.py \
+            --junitxml=acceptance-results/junit.xml 2>&1 | tee acceptance-results/pytest.log
+        env:
+          DBT_DQM_TEST_DSN: host=localhost port=5432 dbname=dbt_dqm_ci user=postgres password=dbtdqm
+
+      # Annotations only report the exit code; keep the full pytest output for diagnosis.
+      - name: Upload acceptance results
+        if: ${{ !cancelled() }}
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: python-${{ matrix.python }}-postgres-${{ matrix.postgres }}-acceptance
+          path: acceptance-results/
+          if-no-files-found: ignore
+
+  bigquery-compile:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Install uv
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Install dependencies
+        run: uv sync --locked --all-groups --extra bigquery
+      - name: Check dependency consistency
+        run: uv pip check
+      - name: Write compile-only profile
+        run: |
+          mkdir -p ~/.dbt
+          cat > ~/.dbt/profiles.yml <<'PROFILES'
+          dbt_dqm_demo:
+            target: ci
+            outputs:
+              ci:
+                type: bigquery
+                method: oauth
+                project: dbt-dqm-compile-only
+                dataset: dbt_dqm_demo
+                location: US
+                threads: 1
+          PROFILES
+      - name: Parse and compile without warehouse introspection
+        working-directory: integration_tests/demo_bigquery
+        run: |
+          uv run dbt deps
+          uv run dbt parse
+          uv run python ../../scripts/compile_bigquery.py
+
+  portability:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [windows-latest, macos-latest]
+        python: ["3.11", "3.12", "3.13", "3.14"]
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Install adapters and development dependencies
+        run: uv sync --locked --all-groups --all-extras
+      - name: Native configuration, process pool and authentication checks
+        run: uv run pytest -q tests/test_runner.py tests/test_portability.py tests/test_config.py tests/test_cli.py tests/test_credentials.py tests/test_dependency_floors.py tests/test_python_compatibility.py tests/test_wif.py tests/test_review_actions.py tests/test_exports.py tests/test_store.py tests/test_ui.py tests/test_ui_browse.py
+      - name: Build and check each installed wheel variant
+        run: |
+          uv build --no-create-gitignore
+          uv run python scripts/check_wheel_variants.py dist/*.whl

dbt_dqm-0.2.0/.github/workflows/release.yml

@@ -0,0 +1,149 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+  id-token: write
+  attestations: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment: pypi
+    services:
+      postgres:
+        image: postgres:16
+        env:
+          POSTGRES_PASSWORD: dbtdqm
+          POSTGRES_DB: dbt_dqm_release
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd pg_isready
+          --health-interval 10s
+          --health-timeout 5s
+          --health-retries 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Check the tag matches the package versions
+        shell: bash
+        run: |
+          set -euo pipefail
+          python_version="$(python3 -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
+          dbt_version="$(python3 -c 'import re; print(re.search(r"^version:\s*[\x27\x22]?([^\x27\x22\s]+)", open("dbt_project.yml").read(), re.M).group(1))')"
+          # dbt only accepts SemVer, so a Python pre-release 0.2.0a1 is spelled 0.2.0-a1 there.
+          expected_dbt_version="$(python3 -c 'import re, sys; print(re.sub(r"^(\d+\.\d+\.\d+)((?:a|b|rc)\d+)$", r"\1-\2", sys.argv[1]))' "$python_version")"
+          if [[ "$dbt_version" != "$expected_dbt_version" ]]; then
+            echo "pyproject.toml ($python_version) and dbt_project.yml ($dbt_version) versions differ; expected dbt version $expected_dbt_version." >&2
+            exit 1
+          fi
+          if [[ "$GITHUB_REF_NAME" != "v$python_version" ]]; then
+            echo "Tag $GITHUB_REF_NAME doesn't match package version v$python_version." >&2
+            exit 1
+          fi
+      - name: Install uv
+        uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          python-version: "3.14"
+      - name: Verify, build, and inspect distributions
+        run: |
+          uv sync --locked --all-groups --all-extras
+          uv run ruff check .
+          uv run pytest -q
+          uv build --no-create-gitignore
+          uvx --from twine twine check dist/*
+      - name: Configure release-gate Postgres
+        run: |
+          psql -h localhost -U postgres -d dbt_dqm_release -c "create extension if not exists pgcrypto;"
+          mkdir -p ~/.dbt
+          cat > ~/.dbt/profiles.yml <<'PROFILES'
+          dbt_dqm_demo_postgres:
+            target: release
+            outputs:
+              release:
+                type: postgres
+                host: localhost
+                port: 5432
+                user: postgres
+                pass: dbtdqm
+                dbname: dbt_dqm_release
+                schema: dbt_dqm_demo
+                threads: 4
+          PROFILES
+        env:
+          PGPASSWORD: dbtdqm
+      - name: Full Postgres release lifecycle
+        working-directory: integration_tests/demo_postgres
+        run: |
+          uv run dbt deps
+          uv run dbt run-operation reset_demo_dqm
+          uv run dbt seed
+          for scenario in initial passed recurrence; do
+            uv run dbt run --select demo_records --vars "{demo_scenario: $scenario}"
+            uv run dbt-dqm run --vars "{demo_scenario: $scenario}"
+            uv run dbt test --select assert_scenario_outcomes --vars "{demo_scenario: $scenario, dqm_enabled: true}"
+          done
+      - name: Attest distribution provenance
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: dist/*
+      - name: Verify distribution provenance
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          shopt -s nullglob
+          wheels=(dist/*.whl)
+          sdists=(dist/*.tar.gz)
+          files=(dist/* dist/.[!.]* dist/..?*)
+          if (( ${#wheels[@]} != 1 || ${#sdists[@]} != 1 || ${#files[@]} != 2 )); then
+            echo 'Expected exactly one wheel and one source archive, with no other distribution files.' >&2
+            exit 1
+          fi
+          for artifact in "${wheels[@]}" "${sdists[@]}"; do
+            if [[ ! -f "$artifact" || -L "$artifact" ]]; then
+              echo "Expected a regular distribution file: $artifact" >&2
+              exit 1
+            fi
+            verified=false
+            for attempt in 1 2 3; do
+              if gh attestation verify "$artifact" \
+                --repo "$GITHUB_REPOSITORY" \
+                --signer-workflow "$GITHUB_REPOSITORY/.github/workflows/release.yml" \
+                --source-digest "$GITHUB_SHA" \
+                --source-ref "$GITHUB_REF" \
+                --deny-self-hosted-runners; then
+                verified=true
+                break
+              fi
+              if (( attempt < 3 )); then
+                sleep 5
+              fi
+            done
+            if [[ "$verified" != true ]]; then
+              echo "Provenance verification failed after three attempts: $artifact" >&2
+              exit 1
+            fi
+          done
+      - name: Publish to PyPI through trusted publishing
+        run: uv publish
+      - name: Create GitHub release
+        run: |
+          set -euo pipefail
+          version="${GITHUB_REF_NAME#v}"
+          if [[ "$version" =~ (a|b|rc)[0-9]+$ ]]; then
+            dbt_version="$(python3 -c 'import re, sys; print(re.sub(r"^(\d+\.\d+\.\d+)((?:a|b|rc)\d+)$", r"\1-\2", sys.argv[1]))' "$version")"
+            gh release create "${GITHUB_REF_NAME}" dist/* --generate-notes --verify-tag \
+              --prerelease --title "dbt-dqm ${GITHUB_REF_NAME} (pre-release)" \
+              --notes "Pre-release: interfaces may change. Install the Python app with pip install 'dbt-dqm[bigquery]==${version}' or 'dbt-dqm[postgres]==${version}' and install the dbt package separately from Git revision ${GITHUB_REF_NAME} (its dbt_project.yml spells the version ${dbt_version}). Version 0.2.0a8 preserves a4-a7 history when resolved names are unchanged. Alias naming now applies to state tables too: changed namespaces require a confirmed fresh start, leaving legacy shared history untouched. Pass matching naming vars to run, app and workspace. The optional --summary reports OPENED (NEW), RECURRING and ARCHIVED changes applied by the reconciliation alongside NEW (status) and ACTIVE workload by saved owner. Quiet test results sort by status and name, and completion reports collections reaching their native limit. Export columns follow review order and timestamp zones are labeled. Upgrades from earlier alphas still require the migration steps documented in README.md. Scheduled full refreshes now require --yes. The app supports cross-page bulk edits and filtered CSV/Excel exports of saved issues. DQM is disabled during ordinary commands. Use dbt-dqm run for full capture and bounded native test limits (default 100). Ownership uses dqm_owner with owner metadata fallback. See README.md and CHANGELOG.md at this tag for supported versions and operating limits."
+          elif [[ "$GITHUB_REF_NAME" == "v0.2.0" ]]; then
+            gh release create "${GITHUB_REF_NAME}" dist/* --notes-file docs/release-notes-0.2.0.md --verify-tag
+          else
+            gh release create "${GITHUB_REF_NAME}" dist/* --generate-notes --verify-tag
+          fi
+        env:
+          GH_TOKEN: ${{ github.token }}

dbt_dqm-0.2.0/.gitignore

@@ -0,0 +1,16 @@
+.venv/
+target/
+dbt_packages/
+logs/
+*.sqlite*
+__pycache__/
+.pytest_cache/
+.ruff_cache/
+.DS_Store
+*.json
+!integration_tests/demo_bigquery/seeds/*.csv
+
+
+# Benchmark results referenced by docs/scale.md (synthetic data only).
+!docs/scale-results/**/*.json
+!docs/scale-results/*.json