Skip to content

ci(dbt): fix dbt CI auth — correct setup docs, add workflow_dispatch #35

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DevDizzle wants to merge 1 commit into
base: master
Choose a base branch
from
Open

ci(dbt): fix dbt CI auth — correct setup docs, add workflow_dispatch #35

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 10 additions & 6 deletions .github/workflows/dbt-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,21 +3,25 @@ name: dbt CI
# Runs `dbt build` (models + tests, DAG order) on every PR that touches the dbt
# project, against an ISOLATED CI dataset so PR builds never touch prod marts.
#
# One-time setup before this passes:
# 1. Create the CI dataset: bq mk --location=us-central1 profitscout-fida8:profitscout_dbt_ci
# Setup (done 2026-07-08 — recorded here in case it needs rebuilding):
# 1. CI dataset: bq mk --location=us-central1 profitscout-fida8:profitscout_dbt_ci
# (must match the source dataset profit_scout, which is us-central1 — a US
# multiregion CI dataset fails at the cross-location read of the sources.)
# 2. Add a GitHub secret GCP_SA_KEY = a service-account JSON with
# BigQuery Data Editor + BigQuery User on profitscout_dbt_ci AND
# BigQuery Data Viewer on profit_scout (to read the source tables).
# Until both exist, the workflow runs but the build step fails at auth — expected.
# 2. GitHub secret GCP_SA_KEY = service-account JSON key for
# github-deployer@profitscout-lx6bb.iam.gserviceaccount.com, granted:
# - roles/bigquery.jobUser on PROJECT profitscout-fida8 (bigquery.jobs.create
# is project-level — a dataset-level grant can never provide it)
# - WRITER on dataset profitscout_dbt_ci (dataset ACL; bq add-iam-policy-binding
# needs allowlisting, use `bq update --source` on the access list instead)
# - READER on dataset profit_scout (source tables)

on:
pull_request:
paths:
- 'dbt/**'
- 'requirements.txt'
- '.github/workflows/dbt-ci.yml'
workflow_dispatch:

jobs:
build:
Expand Down
Loading