ci: test connector images against an SDM base image built from the current branch

[Daryna Ishchenko (darynaishchenko)]

Summary

Closes the third CI gap that let #1076 ship the #1082 regression without any check going red: the Docker image tests always built connector images FROM the already-published SDM base image from metadata.yaml, so the PR branch's CDK was never inside the container. A second gap compounded it — a failing in-container check exits 0 and only reports CONNECTION_STATUS: FAILED, which the harness never asserted on.

Three changes:

1. Base-image override, plumbed end to end — build a connector image FROM an arbitrary (e.g. locally built, unpublished) SDM image:

   build_connector_image(..., base_image_override=...)   # utils/docker.py
   airbyte-cdk image build/test --base-image <image>     # cli/_image.py
   pytest --base-image <image>                           # pytest_hooks.py -> connector_base_image_override fixture -> docker_base.py
   

   base_image_override or metadata.data.connectorBuildOptions.baseImage — metadata remains the default when the flag is absent.

2. The existing "Test Connectors" matrix now tests the branch's CDK inside the container. For manifest-only connectors (source-intercom, source-pokeapi), the matrix job builds airbyte/source-declarative-manifest:dev from the current branch and runs image test --base-image with it — previously those container tests ran the already-released CDK from the published base image, so they couldn't catch a CDK regression pre-release. Python connectors already get the branch CDK in their images: the Bump to Dev Branch CDK step pins the connector's CDK dependency to the branch ref, which the container image's poetry install then picks up.

3. test_docker_image_build_and_check now asserts the check outcome — previously a check returning CONNECTION_STATUS: FAILED (exit code 0, no trace error) passed the test. Now the last connectionStatus must be Status.SUCCEEDED (exception-expecting scenarios are already skipped earlier), so a failing in-container check actually fails the test.

Verified locally with the exact CI command:

• base image = published SDM 7.23.7 (the fix(declarative): require AIRBYTE_ENABLE_UNSAFE_CODE to instantiate Custom* components from YAML #1076 CDK): test_docker_image_build_and_check fails — check reports Custom connector code is not permitted in this environment.
• base image = SDM built from a branch carrying the fix(declarative): allow bundled custom components without AIRBYTE_ENABLE_UNSAFE_CODE #1083 fix: all image tests pass.

Also adds a parametrized unit test asserting base_image_override is threaded into the BASE_IMAGE build arg (and that metadata remains the default).

CI state

While #1083 was unmerged, the matrix container test for source-intercom (bundled components.py) correctly failed on this PR with Custom connector code is not permitted in this environment — proving the guard catches the #1082 regression when the branch-built SDM carries it. Now that #1083 is merged and this branch is updated with main, that check passes.

Note: the new check-outcome assertion also surfaced that destination-motherduck's in-container check has been silently failing in CI (MotherDuck token auth error + a PermissionError), previously masked because the harness ignored CONNECTION_STATUS: FAILED. That looks like a connector-secrets/environment issue, independent of this PR's code.

Summary by CodeRabbit

• New Features

  • Added an optional base-image override for connector image builds and tests.
  • Manifest-only connector testing now builds and uses the appropriate local development base image.
  • Docker-based connector checks now verify successful connection status, not only container exit codes.

• Tests

  • Added coverage for custom and default base-image selection.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

💡 Show Tips and Tricks

Testing This CDK Version

You can test this version of the CDK using the following:

# Run the CLI from this branch:
uvx 'git+https://github.com/airbytehq/airbyte-python-cdk.git@devin/1785245034-ci-image-test-branch-cdk#egg=airbyte-python-cdk[dev]' --help

# Update a connector to use the CDK from this branch ref:
cd airbyte-integrations/connectors/source-example
poe use-cdk-branch devin/1785245034-ci-image-test-branch-cdk

PR Slash Commands

Airbyte Maintainers can execute the following slash commands on your PR:

• /autofix - Fixes most formatting and linting issues
• /poetry-lock - Updates poetry.lock file
• /test - Runs connector tests with the updated CDK
• /prerelease - Triggers a prerelease publish with default arguments
• /poe build - Regenerate git-committed build artifacts, such as the pydantic models which are generated from the manifest JSON schema in YAML.
• /poe <command> - Runs any poe command in the CDK environment

📚 Show Repo Guidance

Helpful Resources

• CDK API Reference

📝 Edit this welcome message.

[coderabbitai]

📝 Walkthrough

Walkthrough

The change adds optional base-image overrides to Docker image builds, CLI commands, and standard tests. Docker check tests now validate emitted connection statuses, and CI builds and uses a local declarative-manifest image for manifest-only connector tests.

Changes

Custom Base Image Testing

Layer / File(s)	Summary
Base image override contract and build wiring airbyte_cdk/utils/docker.py, airbyte_cdk/cli/airbyte_cdk/_image.py, unit_tests/utils/test_docker_build.py	build_connector_image selects an explicit override when provided, CLI build and test commands forward --base-image, and unit tests cover override and metadata fallback behavior.
Standard test integration airbyte_cdk/test/standard_tests/pytest_hooks.py, airbyte_cdk/test/standard_tests/docker_base.py	Pytest exposes --base-image to Docker tests, which pass the override through image builds and assert that check output ends with Status.SUCCEEDED.
Manifest-only CI testing .github/workflows/connector-tests.yml	CI builds airbyte/source-declarative-manifest:dev for manifest-only connectors and passes it to airbyte-cdk image test; other connectors retain the default image-test path.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant AirbyteCDK
  participant Docker
  GitHubActions->>Docker: Build airbyte/source-declarative-manifest:dev
  GitHubActions->>AirbyteCDK: Run image test with --base-image
  AirbyteCDK->>Docker: Build connector image using the local base image
  AirbyteCDK->>Docker: Run connector check
  Docker-->>AirbyteCDK: Return connection status messages

Loading

Suggested reviewers: aaronsteers, girarda, pnilan

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately captures the main CI change: testing connector images against a branch-built SDM base image.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch devin/1785245034-ci-image-test-branch-cdk

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/connector-tests.yml:
- Around line 228-231: Update the “Checkout CDK” actions/checkout step to set
persist-credentials to false, ensuring the checkout token is not retained in Git
configuration while preserving the existing full-history checkout.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0e4c8ffd-b176-4751-a11b-724cd5b0157a

📥 Commits

Reviewing files that changed from the base of the PR and between 7e96546 and 909c48b.

📒 Files selected for processing (6)

• .github/workflows/connector-tests.yml
• airbyte_cdk/cli/airbyte_cdk/_image.py
• airbyte_cdk/test/standard_tests/docker_base.py
• airbyte_cdk/test/standard_tests/pytest_hooks.py
• airbyte_cdk/utils/docker.py
• unit_tests/utils/test_docker_build.py

[github-actions]

PyTest Results (Fast)

4 141 tests  +2   4 129 ✅ +2   7m 51s ⏱️ +2s
    1 suites ±0      12 💤 ±0 
    1 files   ±0       0 ❌ ±0 

Results for commit e4dbd33. ± Comparison against base commit 6ce33ea.

♻️ This comment has been updated with latest results.

[github-actions]

PyTest Results (Full)

4 144 tests   4 132 ✅  9m 18s ⏱️
    1 suites     12 💤
    1 files        0 ❌

Results for commit e4dbd33.

♻️ This comment has been updated with latest results.