From 851a8d9c5e8f2d57433b940b3d54ec18de9625be Mon Sep 17 00:00:00 2001 From: Evan Parra Date: Wed, 8 Jul 2026 19:09:52 +0000 Subject: [PATCH] ci(dbt): document real GCP_SA_KEY identity + grants; add workflow_dispatch MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The setup comment claimed dataset-level "BigQuery User" was enough, but bigquery.jobs.create is project-level only — every CI run failed with Access Denied. The secret's key belongs to github-deployer@profitscout-lx6bb (cross-project); it now has jobUser on the project + WRITER/READER dataset ACLs. workflow_dispatch added so the pipeline can be re-tested manually. Co-Authored-By: Claude Fable 5 --- .github/workflows/dbt-ci.yml | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/.github/workflows/dbt-ci.yml b/.github/workflows/dbt-ci.yml index 131fbf0..c3f58d4 100644 --- a/.github/workflows/dbt-ci.yml +++ b/.github/workflows/dbt-ci.yml @@ -3,14 +3,17 @@ name: dbt CI # Runs `dbt build` (models + tests, DAG order) on every PR that touches the dbt # project, against an ISOLATED CI dataset so PR builds never touch prod marts. # -# One-time setup before this passes: -# 1. Create the CI dataset: bq mk --location=us-central1 profitscout-fida8:profitscout_dbt_ci +# Setup (done 2026-07-08 — recorded here in case it needs rebuilding): +# 1. CI dataset: bq mk --location=us-central1 profitscout-fida8:profitscout_dbt_ci # (must match the source dataset profit_scout, which is us-central1 — a US # multiregion CI dataset fails at the cross-location read of the sources.) -# 2. Add a GitHub secret GCP_SA_KEY = a service-account JSON with -# BigQuery Data Editor + BigQuery User on profitscout_dbt_ci AND -# BigQuery Data Viewer on profit_scout (to read the source tables). -# Until both exist, the workflow runs but the build step fails at auth — expected. +# 2. GitHub secret GCP_SA_KEY = service-account JSON key for +# github-deployer@profitscout-lx6bb.iam.gserviceaccount.com, granted: +# - roles/bigquery.jobUser on PROJECT profitscout-fida8 (bigquery.jobs.create +# is project-level — a dataset-level grant can never provide it) +# - WRITER on dataset profitscout_dbt_ci (dataset ACL; bq add-iam-policy-binding +# needs allowlisting, use `bq update --source` on the access list instead) +# - READER on dataset profit_scout (source tables) on: pull_request: @@ -18,6 +21,7 @@ on: - 'dbt/**' - 'requirements.txt' - '.github/workflows/dbt-ci.yml' + workflow_dispatch: jobs: build: