ci: add dbt tests workflow

[julianam-w]

Summary

• Adds caller workflow for the reusable dbt-tests.yml from maui-team
• Runs dbt test against a live database on PRs and pushes to main
• Requires DBT_HOST, DBT_DBNAME, DBT_USER, and DBT_PASSWORD repository secrets to be configured
• Target schema defaults to reporting (override via dbt-schema input)

Test plan

• Verify required secrets are configured in repo settings
• Open a test PR to confirm the workflow triggers and passes

🤖 Generated with Claude Code

[github-actions]

Claude finished @julianam-w's task in 57s —— View job

---

Review: ci: add dbt tests workflow

✅ Approved — 0 blockers · 1 suggestion · 1 nit

---

.github/workflows/dbt-tests.yml

Overall: Clean, minimal caller workflow. Consistent with the existing pattern used in build-reporting-assets.yml (which also delegates to beyondessential/maui-team reusable workflows via secrets: inherit). No security issues — pull_request events from forks do not expose repo secrets, so there's no risk of credential exfiltration via a malicious PR.

🟡 Suggestion — pin the reusable workflow to a commit SHA

uses: beyondessential/maui-team/.github/workflows/dbt-tests.yml@main

Referencing @main means any push to that branch silently changes what runs here. A compromised or accidentally broken upstream would affect this repo without any visible change in its own history. Consider pinning to a commit SHA (with the tag as a comment) for reproducibility and supply-chain safety:

uses: beyondessential/maui-team/.github/workflows/dbt-tests.yml@<commit-sha> # main

That said, the existing workflows in this repo (build-reporting-assets.yml, claude-code-review.yml) use @main consistently, so this is a repo-wide pattern — raising it here for awareness rather than blocking.

🔵 Nit — consider adding workflow_dispatch for manual reruns

When secrets are misconfigured or a transient DB connection issue occurs, there's no way to rerun without pushing a new commit. A workflow_dispatch trigger is low-cost insurance:

on:
  pull_request:
    types: [opened, reopened, synchronize]
  push:
    branches: [main]
  workflow_dispatch:

---

.maui submodule

Submodule bump from 79ef2bd → bb8c5bd. Routine housekeeping to pick up the latest .maui baseline — no concerns.

---

Regression testing

# After secrets are configured in repo settings:
# Open a test PR and verify the dbt-tests workflow appears and passes
# Check Actions tab to confirm the reusable workflow resolves correctly