Skip to content

ci(bq): env-driven test constants + GCP project setup runbook - #9

Closed
ihistand wants to merge 1 commit into
adapter/postgres-skeletonfrom
ci/bq-test-creds-env
Closed

ci(bq): env-driven test constants + GCP project setup runbook#9
ihistand wants to merge 1 commit into
adapter/postgres-skeletonfrom
ci/bq-test-creds-env

Conversation

@ihistand

Copy link
Copy Markdown
Collaborator

Summary

Makes the BigQuery integration test constants in `cli/index_test_base.ts` read from environment variables so that the test project ID isn't committed to source. Adds a setup runbook at `docs/gcp_test_project_setup.md` describing how to spin up a dedicated GCP test project.

Why

Currently 2 of the 3 failing tests on `main` are blocked by missing BigQuery credentials:

Test Cause
`//cli:index_run_e2e_test` `Missing credentials JSON file; not found at path 'test_credentials/bigquery.json'`
`//tests/integration:bigquery.spec` Same
`//tests/api:projects.spec` Not a creds issue — separate pre-existing schema-mismatch bug

Once a contributor follows the runbook to provision a GCP project and exports the env vars, those two BQ tests pass.

Constants

`cli/index_test_base.ts` now reads from env vars with safe sentinels:

Env var Default Purpose
`SQLANVIL_TEST_BQ_PROJECT` `"your-bigquery-project"` (fails loudly when used at runtime) Project ID
`SQLANVIL_TEST_BQ_LOCATION` `"US"` BQ region
`SQLANVIL_TEST_BQ_RESERVATION` `""` (on-demand pricing, no reservation needed) Optional reservation path

Runbook contents (`docs/gcp_test_project_setup.md`)

  • Why a dedicated project (blast radius, billing isolation, IAM)
  • Free-tier cost expectations ($0/mo expected for normal contributor cadence)
  • `gcloud`-only setup walkthrough (no console clicking)
  • Least-privilege IAM (`bigquery.dataEditor` + `bigquery.jobUser` only — no `roles/owner`)
  • `.gitignore` hardening for `test_credentials/*.json`
  • GitHub Actions CI integration with `SQLANVIL_TEST_BQ_KEY` secret
  • Fork-PR safety (don't expose secrets to fork PRs — recommend running BQ tests post-merge only)
  • Billing budget alerts ($5/mo at 50%/100% thresholds)
  • Daily BQ query quota cap (100 GiB) as hard guardrail
  • Annual key rotation procedure
  • Troubleshooting common failures
  • Tear-down (`gcloud projects delete` with 30-day grace)

.gitignore

Added `test_credentials/*.json` to keep service-account keys out of commits even if a contributor names theirs something other than `bigquery.json`.

Verification

```bash
./scripts/docker-bazel build //cli/... # → 23 targets, success
```

Test fix not verifiable in this PR — requires a real GCP project. The runbook walks Ivan through provisioning one, after which:

```bash
export SQLANVIL_TEST_BQ_PROJECT="sqlanvil-test-XXX"
./scripts/docker-bazel test //tests/integration:bigquery.spec
```

should pass.

Stack

Stacked on PR #7 (`adapter/postgres-skeleton`). Merge order: #1#2#3#4#5#6#7 → this.

Out of scope

  • The third failing test (`//tests/api:projects.spec`) — separate PR, separate root cause.
  • `@google-cloud/bigquery` SDK upgrades — current pin works.
  • Postgres integration test creds — those use the local Docker fixture (`tools/postgres/postgres_fixture.ts`) per Phase 6 of the postgres-first-class design.

Test plan

  • `./scripts/docker-bazel build //cli/...` succeeds
  • After provisioning the GCP test project per runbook, BQ integration tests pass locally
  • CI workflow added (separate PR — depends on someone having created the GCP project + GitHub secrets)

🤖 Generated with Claude Code

Makes the BigQuery integration test constants in cli/index_test_base.ts
read from environment variables so that the test project ID isn't
committed to source. Adds a setup runbook at
docs/gcp_test_project_setup.md.

Constants now read from:
  SQLANVIL_TEST_BQ_PROJECT       — defaults to "your-bigquery-project"
                                   (compile-only sentinel; tests fail
                                   loudly when used)
  SQLANVIL_TEST_BQ_LOCATION      — defaults to "US"
  SQLANVIL_TEST_BQ_RESERVATION   — defaults to "" (on-demand pricing,
                                   no reservation needed)

This unblocks the two BQ tests that currently fail with
"Missing credentials JSON file":

  //cli:index_run_e2e_test
  //tests/integration:bigquery.spec

Contributors who want to run these locally now follow the runbook to
spin up a dedicated GCP test project (~30 min one-time setup; $0/mo
expected on BigQuery free tier).

Runbook contents:
  - Why a dedicated project (blast radius, billing isolation, IAM)
  - Free-tier cost expectations
  - gcloud-only setup walkthrough (no console steps)
  - Least-privilege IAM (no roles/owner — bigquery.dataEditor +
    bigquery.jobUser only)
  - .gitignore hardening for test_credentials/*.json
  - GitHub Actions CI integration with the SQLANVIL_TEST_BQ_KEY secret
  - Fork-PR safety guidance (don't expose secrets to fork PRs)
  - Billing budget alerts, daily quota caps, key rotation
  - Troubleshooting common failures
  - Tear-down (gcloud projects delete with 30-day grace)

The third failing test (//tests/api:projects.spec) is NOT fixed by
this — it's an unrelated pre-existing schema-mismatch bug on the
`warehouse` property in workflow_settings validation.

Verified:
  ./scripts/docker-bazel build //cli/...   → 23 targets, success
@ihistand

ihistand commented Jun 7, 2026

Copy link
Copy Markdown
Collaborator Author

Superseded: the Postgres reintegration + Dataform→SQLAnvil rename landed on main directly, and the docs moved to the SQLAnvil/docs repo. Closing as part of #12 (stale-branch prune). The one un-migrated draft, gcp_test_project_setup.md, was migrated to SQLAnvil/docs.

@ihistand ihistand closed this Jun 7, 2026
@ihistand
ihistand deleted the ci/bq-test-creds-env branch June 7, 2026 01:45
ihistand added a commit that referenced this pull request Jul 21, 2026
…a post_operations)

Mirrors the agent-skills SKILL.md update: delta #10 expanded with the AI/BI
framing (descriptions/columns persist as catalog comments, join targets named
in column descriptions, PK/FK via post_operations with NOT ENFORCED on
BigQuery targets, uniqueKey/uniqueKeys exclusivity, catalog artifacts, guide
link); delta #9 covers FKs; delta #11 NOT-ENFORCED flag scoped.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W86VUf4ptKnmhxWoqgA7gb
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant