feat: release v0.13.0 — expand Reconcile capabilities, add SQL/Oracle/Redshift profilers, and upgrade runtime dependencies

.build-constraints.txt

@@ -1,13 +1,13 @@
 hatchling==1.29.0 \
     --hash=sha256:50af9343281f34785fab12da82e445ed987a6efb34fd8c2fc0f6e6630dbcc1b0 \
     --hash=sha256:793c31816d952cee405b83488ce001c719f325d9cda69f1fc4cd750527640ea6
-packaging==26.0 \
-    --hash=sha256:00243ae351a257117b6a241061796684b084ed1c516a08c48a3f7e147a9d80b4 \
-    --hash=sha256:b36f1fef9334a5588b4166f8bcd26a14e521f2b55e6b9de3aaa80d3ff7a37529
+packaging==26.2 \
+    --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e \
+    --hash=sha256:ff452ff5a3e828ce110190feff1178bb1f2ea2281fa2075aadb987c2fb221661
     # via hatchling
-pathspec==1.0.4 \
-    --hash=sha256:0210e2ae8a21a9137c0d470578cb0e595af87edaa6ebf12ff176f14a02e0e645 \
-    --hash=sha256:fb6ae2fd4e7c921a165808a552060e722767cfa526f99ca5156ed2ce45a5c723
+pathspec==1.1.1 \
+    --hash=sha256:17db5ecd524104a120e173814c90367a96a98d07c45b2e10c2f3919fff91bf5a \
+    --hash=sha256:a00ce642f577bf7f473932318056212bc4f8bfdf53128c78bbd5af0b9b20b189
     # via hatchling
 pluggy==1.6.0 \
     --hash=sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3 \
@@ -62,7 +62,7 @@ tomli==2.4.1 ; python_full_version < '3.11' \
     --hash=sha256:ff18e6a727ee0ab0388507b89d1bc6a22b138d1e2fa56d1ad494586d61d2eae9 \
     --hash=sha256:ff2983983d34813c1aeb0fa89091e76c3a22889ee83ab27c5eeb45100560c049
     # via hatchling
-trove-classifiers==2026.1.14.14 \
-    --hash=sha256:00492545a1402b09d4858605ba190ea33243d361e2b01c9c296ce06b5c3325f3 \
-    --hash=sha256:1f9553927f18d0513d8e5ff80ab8980b8202ce37ecae0e3274ed2ef11880e74d
+trove-classifiers==2026.6.1.19 \
+    --hash=sha256:ab4c4ec93cc4a4e7815fa759906e05e6bb3f2fbd92ea0f897288c6a43efd15b3 \
+    --hash=sha256:c5132b4b61a829d11cfbd2d72e97f20a45ed6edb95e45c5efdeb5e00836b2745
     # via hatchling

.github/actions/jfrog-auth/action.yml

@@ -1,8 +1,8 @@
 name: 'Authenticate for JFrog'
 description: 'Authenticate with JFrog using OIDC based on the GitHub repository.'
 # Some things to note:
-#  - Run this _after_ installing any tools that need to use JFrog; auth is configured all the (supported) tools that it
-#    detects.
+#  - Run this _after_ installing any tools that need to use JFrog; auth is configured for all the (supported) tools that
+#    it detects.
 #  - Where possible we avoid exposing tokens in environment variables, preferring to write them into files instead.
 #    (Tokens in environment variables tend to be more exposed and easier to leak than those written into files.)
 #
@@ -18,17 +18,22 @@ runs:
       name: Authenticate against JFrog
       shell: bash
       run: |
+        if [[ -z "${ACTIONS_ID_TOKEN_REQUEST_URL}" ]] || [[ -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" ]]
+        then
+            printf '::error::%s\n' 'This action uses OIDC: job must have "id-token: write" permission'
+            exit 1
+        fi
         "${GITHUB_ACTION_PATH}/jfrog-auth" "${ACTIONS_ID_TOKEN_REQUEST_URL}" "${ACTIONS_ID_TOKEN_REQUEST_TOKEN}"
 
     - id: detect-cmds
-      name: Detecting python package/project managers.
+      name: Detecting package/project managers.
       shell: bash
       run: |
-        for cmd in bun mvn npm pip3 uv
+        for cmd in bun coursier mvn npm pip3 sbt uv
         do
-          command -v "${cmd}" > /dev/null && found=true || found=false
-          printf '::debug::%s\n' "Found ${cmd}: ${found}"
-          printf '%s=%s\n' "command_${cmd}" "${found}" >> "${GITHUB_OUTPUT}"
+            command -v "${cmd}" > /dev/null && found=true || found=false
+            printf '::debug::%s\n' "Found ${cmd}: ${found}"
+            printf '%s=%s\n' "command_${cmd}" "${found}" >> "${GITHUB_OUTPUT}"
         done
 
     - name: Configure bun for JFrog
@@ -38,7 +43,7 @@ runs:
         JFROG_ACCESS_TOKEN: "${{ steps.jfrog-auth.outputs.jfrog-access-token }}"
       run: |
         umask 077
-        cat > ~/.bunfig.toml << EOF
+        cat > ~/.bunfig.toml << 'EOF'
         [install]
         registry = { url = "https://databricks.jfrog.io/artifactory/api/npm/db-npm/", token = "$jfrog_access_token" }
         EOF
@@ -51,24 +56,28 @@ runs:
         # There are currently the following issues with JFrog:
         #  - The default set of CAs doesn't seem to cover the ones used by our JFrog instance.
         #  - The JSON metadata returned for some NPM artefacts can be invalid JSON.
-        printf '::warning::%s\n' 'JFrog has compatibility issues with bun; it probably won't work.'
+        printf '::warning::%s\n' 'JFrog has compatibility issues with bun; it will probably not work.'
 
-    - name: Configure pip for JFrog
-      if: "${{ steps.detect-cmds.outputs.command_pip3 == 'true' }}"
+    - name: Configure coursier for JFrog
+      # Note: SBT bootstrapping uses Coursier internally.
+      if: "${{ steps.detect-cmds.outputs.command_coursier == 'true' ||
+               steps.detect-cmds.outputs.command_sbt == 'true' }}"
       shell: bash
       env:
         JFROG_ACCESS_TOKEN: "${{ steps.jfrog-auth.outputs.jfrog-access-token }}"
       run: |
         umask 077
-        cat > "$RUNNER_TEMP/.pip.conf" <<EOF
-        [global]
-        index-url = https://gha-service-account:${JFROG_ACCESS_TOKEN}@databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple
+        cat > "${RUNNER_TEMP}/.coursier-credentials.properties" << EOF
+        jfrog.host=databricks.jfrog.io
+        jfrog.realm=Artifactory Realm
+        jfrog.username=gha-service-account
+        jfrog.password=${JFROG_ACCESS_TOKEN}
         EOF
-        printf '%s=%s\n' 'PIP_CONFIG_FILE' "${RUNNER_TEMP}/.pip.conf" >> "${GITHUB_ENV}"
-        printf '::debug::%s\n' 'Configured JFrog access for pip.'
+        printf '%s=%s\n' 'COURSIER_CREDENTIALS' "${RUNNER_TEMP}/.coursier-credentials.properties" >> "${GITHUB_ENV}"
+        printf '::debug::%s\n' 'Configured JFrog access for Coursier.'
 
     - name: Configure Maven for JFrog
-      if: "${{ steps.detect-cmds.outputs.command_uv == 'true' }}"
+      if: "${{ steps.detect-cmds.outputs.command_mvn == 'true' }}"
       shell: bash
       env:
         JFROG_ACCESS_TOKEN: "${{ steps.jfrog-auth.outputs.jfrog-access-token }}"
@@ -95,17 +104,20 @@ runs:
         EOF
         printf '::debug::%s\n' 'Configured JFrog access for maven.'
 
-    - name: Configure uv for JFrog
-      if: "${{ steps.detect-cmds.outputs.command_uv == 'true' }}"
+    - name: Configure netrc for JFrog
+      if: "${{ steps.detect-cmds.outputs.command_pip3 == 'true' ||
+               steps.detect-cmds.outputs.command_uv == 'true' }}"
       shell: bash
       env:
         JFROG_ACCESS_TOKEN: "${{ steps.jfrog-auth.outputs.jfrog-access-token }}"
-        UV_INDEX_URL: 'https://databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple'
       run: |
-        uv auth login "${UV_INDEX_URL}" --username gha-service-account --password "${JFROG_ACCESS_TOKEN}"
-        printf '%s=%s\n' 'UV_INDEX_URL' "${UV_INDEX_URL}" >> "${GITHUB_ENV}"
-        printf '%s=%s\n' 'UV_FROZEN' '1' >> "${GITHUB_ENV}"
-        printf '::debug::%s\n' 'Configured JFrog access for uv.'
+        umask 077
+        cat > "${RUNNER_TEMP}/.netrc" << EOF
+        machine databricks.jfrog.io
+        login gha-service-account
+        password ${JFROG_ACCESS_TOKEN}
+        EOF
+        printf '%s=%s\n' 'NETRC' "${RUNNER_TEMP}/.netrc" >> "${GITHUB_ENV}"
 
     - name: Configure npm/yarn (classic) for JFrog
       if: "${{ steps.detect-cmds.outputs.command_npm == 'true' }}"
@@ -121,3 +133,50 @@ runs:
         //databricks.jfrog.io/artifactory/api/npm/db-npm/:_authToken=${JFROG_ACCESS_TOKEN}
         EOF
         printf '::debug::%s\n' 'Configured JFrog access for npm/yarn (classic).'
+
+    - name: Configure pip for JFrog
+      if: "${{ steps.detect-cmds.outputs.command_pip3 == 'true' }}"
+      shell: bash
+      run: |
+        cat > "${RUNNER_TEMP}/.pip.conf" << 'EOF'
+        [global]
+        index-url = https://databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple
+        EOF
+        printf '%s=%s\n' 'PIP_CONFIG_FILE' "${RUNNER_TEMP}/.pip.conf" >> "${GITHUB_ENV}"
+        printf '::debug::%s\n' 'Configured JFrog access for pip.'
+
+    - name: Configure sbt for JFrog
+      if: "${{ steps.detect-cmds.outputs.command_sbt == 'true' }}"
+      shell: bash
+      env:
+        JFROG_ACCESS_TOKEN: "${{ steps.jfrog-auth.outputs.jfrog-access-token }}"
+      run: |
+        umask 077
+        mkdir -p ~/.sbt/1.0
+        cat > ~/.sbt/repositories << 'EOF'
+        [repositories]
+          local
+          databricks-jfrog: https://databricks.jfrog.io/artifactory/db-maven/
+        EOF
+
+        cat > "${RUNNER_TEMP}/.sbt.credentials" << EOF
+        realm=Artifactory Realm
+        host=databricks.jfrog.io
+        user=gha-service-account
+        password=${JFROG_ACCESS_TOKEN}
+        EOF
+
+        cat > ~/.sbt/1.0/global.sbt << 'EOF'
+        credentials += Credentials(file(sys.env("RUNNER_TEMP")) / ".sbt.credentials")
+        EOF
+        printf '::debug::%s\n' 'Configured JFrog access for SBT.'
+
+    - name: Configure uv for JFrog
+      if: "${{ steps.detect-cmds.outputs.command_uv == 'true' }}"
+      shell: bash
+      env:
+        UV_INDEX_URL: 'https://databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple'
+      run: |
+        printf '%s=%s\n' 'UV_INDEX_URL' "${UV_INDEX_URL}" >> "${GITHUB_ENV}"
+        printf '%s=%s\n' 'UV_FROZEN' '1' >> "${GITHUB_ENV}"
+        printf '::debug::%s\n' 'Configured JFrog access for uv.'

.github/actions/jfrog-auth/jfrog-auth

@@ -22,7 +22,7 @@ printf '::add-mask::%s\n' "${_id_token}"
 # Step 2: Exchange it for the JFrog access token.
 #
 printf '::debug::%s\n' "Exchanging OIDC identifier token for JFrog access token..."
-_access_token=$(curl -sLS \
+_access_token=$(curl -fsSL \
     --json "{\"grant_type\": \"urn:ietf:params:oauth:grant-type:token-exchange\", \"subject_token_type\":\"urn:ietf:params:oauth:token-type:id_token\", \"subject_token\": \"${_id_token}\", \"provider_name\": \"github-actions\"}" \
     "https://databricks.jfrog.io/access/api/v1/oidc/token" |
     jq -r .access_token)

.github/scripts/lint-uv

@@ -0,0 +1,143 @@
+#!/bin/sh
+#
+# Check the uv settings of the project, to ensure dependencies are being updated properly.
+#
+# The intent here is that:
+#
+#  - Lock-files should only be updated via the `make lock-dependencies` target.
+#  - We only re-lock when:
+#     - Updating the project dependencies in some way.
+#     - Refreshing the locked versions, where that is the sole purpose of the PR.
+#  - Developer environment information should not be present in the lock-file; it should be usable by the public.
+#
+# The checks that we perform to enforce this are:
+#  - The only registry we should see in uv.lock is "https://pypi.org/simple".
+#  - The uv.lock file must be consistent with pyproject.toml.
+#  - If changes to uv.lock are present, there must be no other files changed in the PR _or_ pyproject.toml must also
+#    be updated.
+#  - The same applies to .build-constraints.txt.
+#
+
+set -eu
+
+PROGNAME="${0##*/}"
+die() {
+    _exitcode="$1"
+    shift
+    printf "%s: %s\n" "${PROGNAME}" "$*" 1>&2
+
+    exit "${_exitcode}"
+}
+
+# Locate the root of the project.
+PROJECT_ROOT="$(git rev-parse --show-toplevel)"
+
+# Set up a scratch directory for temporary files during the check.
+SCRATCH="$(mktemp -d -t "${PROGNAME}.XXX")"
+trap 'rm -fr "${SCRATCH}"' EXIT
+
+# This script handles the locked/frozen flags for uv itself.
+unset UV_FROZEN UV_LOCKED
+
+tomlq() {
+    # Assumes typical project setup: tomlq is present (and locked).
+    uv run --frozen --quiet --group yq tomlq "$@"
+}
+
+#
+# Check 1: Verify that uv.lock refers only to PyPI as a registry.
+#
+check_lock_registry() {
+    # Collect all registry URLs present in uv.lock, except for the only one we allow.
+    tomlq --raw-output \
+        '[.. | objects | .source.registry // empty] - ["https://pypi.org/simple"] | unique | .[]' \
+        "${PROJECT_ROOT}/uv.lock" > "${SCRATCH}/foreign-registries.txt"
+    if [ -s "${SCRATCH}/foreign-registries.txt" ]
+    then
+        printf "%s: Detected non-PyPI registries:\n" "${PROGNAME}"
+        sed 's/^/  /' "${SCRATCH}/foreign-registries.txt"
+        die 1 "uv.lock may only contain PyPI registries."
+    fi
+}
+check_lock_registry
+
+#
+# Check 2: Verify that uv.lock is consistent with pyproject.toml.
+#
+
+detect_index_url() {
+    # Annoyingly, there is no way to query from uv the index URL it's going to use; the only approach is to use a fake
+    # project and ask to resolve, then dig the index URL out of the results.
+    mkdir -p "${SCRATCH}/uvtest"
+    cat > "${SCRATCH}/uvtest/pyproject.toml" << 'EOF'
+[project]
+name = "uvtest"
+version = "0"
+requires-python = ">=3.10"
+dependencies = ["packaging"]
+EOF
+    uv lock --quiet --project "${SCRATCH}/uvtest"
+    tomlq --raw-output 'first(.package[].source.registry // empty)' "${SCRATCH}/uvtest/uv.lock"
+}
+
+check_lock_consistency() {
+    # We can't check uv.lock directly, because we can't reach the registry recorded in there. Instead we make a shadow
+    # version of this project and check that.
+    index_url="$(detect_index_url)"
+    [ -n "${index_url}" ] || die 2 "Could not detect the URL to use for PyPI."
+    mkdir -p "${SCRATCH}/shadow-project"
+    ln -s \
+        "${PROJECT_ROOT}/README.md" \
+        "${PROJECT_ROOT}/pyproject.toml" \
+        "${PROJECT_ROOT}/src" \
+        "${SCRATCH}/shadow-project/"
+    # shellcheck disable=SC2016  # $index_url is a jq variable, bound via --arg
+    tomlq --toml-output --arg index_url "${index_url}" \
+        '(.. | objects | .source | select(.registry? == "https://pypi.org/simple")).registry = $index_url' \
+        "${PROJECT_ROOT}/uv.lock" > "${SCRATCH}/shadow-project/uv.lock"
+    uv lock --project "${SCRATCH}/shadow-project" --check --quiet ||
+          die 2 "Inconsistency detected between pyproject.toml and uv.lock."
+}
+check_lock_consistency
+
+#
+# Check 3: Detect if uv.lock or .build-constraints.txt have been updated with pyproject.toml or on their own.
+#
+
+base_rev() {
+    # A few situations to deal with, in order of priority:
+    #  - In CI, we set BASE_SHA for pull requests and the merge queue.
+    #  - In CI, we also have the push to main where there's no base: in this case we can use GITHUB_REF and diff will
+    #    end up a no-op (because there are no differences).
+    #  - For local dev, fall-back to `main` which by convention is always available.
+    _base_rev="${BASE_SHA:-${GITHUB_REF:-main}}"
+    git rev-parse --verify --quiet "${_base_rev}" > /dev/null ||
+        die 3 "Base revision of repository is not available: ${_base_rev}"
+    printf "%s" "${_base_rev}"
+}
+merge_base() {
+    # Figure out the merge-base between this branch and verify it's available. (CI checkout might be shallow.)
+    _tip="$1"
+    _base_rev=$(base_rev)
+    if ! git merge-base "${_base_rev}" "${_tip}" 2> /dev/null
+    then
+        die 4 "Repository is incomplete, merge base between ${_base_rev} and ${_tip} is not available."
+    fi
+}
+
+check_lockfile_updates() {
+    _merge_base=$(merge_base HEAD)
+    git diff "${_merge_base}..HEAD" --name-only > "${SCRATCH}/changed-files.txt"
+
+    if grep -qxF -e 'uv.lock' -e '.build-constraints.txt' "${SCRATCH}/changed-files.txt"
+    then
+        # Lock-files changed: either pyproject.toml has to be changed, or nothing else is allowed.
+        if grep -vxF -e 'uv.lock' -e '.build-constraints.txt' "${SCRATCH}/changed-files.txt" > "${SCRATCH}/other-files.txt" && ! grep -qxF 'pyproject.toml' "${SCRATCH}/other-files.txt"
+        then
+            printf "%s: Detected changes to uv.lock and/or .build-constraints.txt mixed with changes to:\n" "${PROGNAME}"
+            sed -e 's/^/  /' "${SCRATCH}/other-files.txt"
+            die 5 "Lock-files must be updated either in conjunction with dependencies in pyproject.toml or on their own."
+        fi
+    fi
+}
+check_lockfile_updates