Update

.github/ISSUE_TEMPLATE/bug_report.md

@@ -25,8 +25,14 @@ If applicable, add screenshots to help explain your problem.
 
 **Environment (please complete the following information):**
 
-- edr Version: [e.g. 0.5.3], can be found by running `pip show elementary-data`
-- dbt package Version: [e.g. 0.4.1], can be found in `packages.yml` file
+- Elementary CLI (edr) version: [e.g. 0.5.3], can be found by running `pip show elementary-data`
+- Elementary dbt package version: [e.g. 0.4.1], can be found in `packages.yml` file
+- dbt version you're using [e.g. 1.8.1]
+- Data warehouse [e.g. snowflake]
+- Infrastructure details (e.g. operating system, prod / dev / staging, deployment infra, CI system, etc)
 
 **Additional context**
 Add any other context about the problem here.
+
+**Would you be willing to contribute a fix for this issue?**
+Let us know if you're willing to contribute so that we'll be able to provide guidance.

.github/workflows/assign-devin-prs.yml

@@ -0,0 +1,34 @@
+name: Auto-assign Devin PRs
+
+on:
+  pull_request:
+    types: [opened]
+
+permissions: {}
+
+jobs:
+  assign:
+    if: github.actor == 'devin-ai-integration[bot]'
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      issues: write
+    steps:
+      - name: Extract and assign requesting user
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const body = context.payload.pull_request.body || '';
+            const match = body.match(/Requested by[:\s]*(?:@(\w[\w-]*)|[\w][\w\s]*\(@(\w[\w-]*)\))/);
+            const user = match?.[1] || match?.[2];
+            if (user) {
+              await github.rest.issues.addAssignees({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                assignees: [user]
+              });
+              console.log(`Assigned PR #${context.issue.number} to @${user}`);
+            } else {
+              console.log('Could not determine requesting user from PR description');
+            }

.github/workflows/build-docker-image.yml

@@ -0,0 +1,47 @@
+name: Build Docker image
+on:
+  workflow_dispatch:
+
+permissions: {}
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}
+
+jobs:
+  build-and-push-docker-image:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout Elementary
+        uses: actions/checkout@v6
+
+      - name: Set up QEMU for multi-platform support
+        uses: docker/setup-qemu-action@v4
+
+      - name: Set up Docker Buildx for multi-platform support
+        uses: docker/setup-buildx-action@v4
+
+      - name: Log in to the container registry
+        uses: docker/login-action@v4
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      - name: Build Docker image
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          push: false
+          platforms: linux/amd64,linux/arm64
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

.github/workflows/bump-version.yml

@@ -20,72 +20,101 @@ on:
         type: string
         required: false
 
+permissions: {}
+
 jobs:
   validate-version:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
       validated-cli-version: ${{ steps.validate-cli-input.outputs.cli-validation }}
       default-dbt-package-version: ${{ steps.validate-cli-input.outputs.cli-validation }}
       validated-dbt-package-version: ${{ steps.validate-dbt-package-input.outputs.dbt-package-validation }}
     steps:
       - name: validate cli version input
         id: validate-cli-input
-        run: echo "cli-validation=$(echo ${{ inputs.cli-version }} | sed -n '/^[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*$/p')" >> $GITHUB_OUTPUT
+        env:
+          CLI_VERSION: ${{ inputs.cli-version }}
+        run: |
+          if [[ "$CLI_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "cli-validation=$CLI_VERSION" >> "$GITHUB_OUTPUT"
+          fi
       - name: validate dbt package version
         if: ${{ inputs.dbt-package-version }}
         id: validate-dbt-package-input
-        run: echo "dbt-package-validation=$(echo ${{ inputs.dbt-package-version }} | sed -n '/^[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*$/p')" >> $GITHUB_OUTPUT
+        env:
+          DBT_PACKAGE_VERSION: ${{ inputs.dbt-package-version }}
+        run: |
+          if [[ "$DBT_PACKAGE_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "dbt-package-validation=$DBT_PACKAGE_VERSION" >> "$GITHUB_OUTPUT"
+          fi
       - name: echo versions
+        env:
+          CLI_VERSION: ${{ steps.validate-cli-input.outputs.cli-validation }}
+          DBT_PACKAGE_VERSION: ${{ steps.validate-dbt-package-input.outputs.dbt-package-validation }}
         run: |
-          echo "cli version: ${{ steps.validate-cli-input.outputs.cli-validation }}"
-          echo "dbt package version: ${{ steps.validate-dbt-package-input.outputs.dbt-package-validation }}"
+          echo "cli version: $CLI_VERSION"
+          echo "dbt package version: $DBT_PACKAGE_VERSION"
       - name: fail on invalid input
-        if: ${{ steps.validate-cli-input.outputs.cli-validation == '' }}
-        uses: actions/github-script@v6
+        if: ${{ steps.validate-cli-input.outputs.cli-validation == '' || (inputs.dbt-package-version != '' && steps.validate-dbt-package-input.outputs.dbt-package-validation == '') }}
+        uses: actions/github-script@v8
         with:
           script: |
             core.setFailed("Invalid version inputs")
 
   bump-version:
     needs: validate-version
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    env:
+      CLI_VERSION: ${{ needs.validate-version.outputs.validated-cli-version }}
+      DBT_PACKAGE_VERSION: ${{ needs.validate-version.outputs.validated-dbt-package-version || needs.validate-version.outputs.default-dbt-package-version }}
+      RELEASE_BRANCH: release/v${{ needs.validate-version.outputs.validated-cli-version }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
       - name: Create release branch
-        run: git checkout -b release/v${{ inputs.cli-version }}
+        run: git checkout -b "$RELEASE_BRANCH"
       - name: Initial config
         run: |
           git config user.name "GitHub Actions"
           git config user.email noreply@github.com
       - name: Bump version
         run: |
-          sed -i 's/^version = "[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*"/version = "${{ inputs.cli-version }}"/' ./pyproject.toml
+          sed -i "s/^version = \"[0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*\"/version = \"$CLI_VERSION\"/" ./pyproject.toml
       - name: Bump version for package (using input)
         if: ${{ needs.validate-version.outputs.validated-dbt-package-version != ''}}
         run: |
-          sed -i 's/version: [0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*$/version: ${{ needs.validate-version.outputs.validated-dbt-package-version }}/' ./elementary/monitor/dbt_project/packages.yml
-          sed -i 's/version: [0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*$/version: ${{ needs.validate-version.outputs.validated-dbt-package-version }}/' ./docs/_snippets/quickstart-package-install.mdx
+          sed -i "s/version: [0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*$/version: $DBT_PACKAGE_VERSION/" ./elementary/monitor/dbt_project/packages.yml
+          sed -i "s/version: [0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*$/version: $DBT_PACKAGE_VERSION/" ./docs/_snippets/quickstart-package-install.mdx
       - name: Bump version for package (using default)
         if: ${{ needs.validate-version.outputs.validated-dbt-package-version == ''}}
         run: |
-          sed -i 's/version: [0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*$/version: ${{ needs.validate-version.outputs.default-dbt-package-version }}/' ./elementary/monitor/dbt_project/packages.yml
-          sed -i 's/version: [0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*$/version: ${{ needs.validate-version.outputs.default-dbt-package-version }}/' ./docs/_snippets/quickstart-package-install.mdx
+          sed -i "s/version: [0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*$/version: $DBT_PACKAGE_VERSION/" ./elementary/monitor/dbt_project/packages.yml
+          sed -i "s/version: [0-9][0-9]*\.[0-9][0-9]*\.[0-9][0-9]*$/version: $DBT_PACKAGE_VERSION/" ./docs/_snippets/quickstart-package-install.mdx
       - name: Commit changes
-        run: git commit -am "release v${{ inputs.cli-version }}"
+        run: git commit -am "release v$CLI_VERSION"
       - name: Push code
-        run: git push origin release/v${{ inputs.cli-version }}
+        run: git push origin "$RELEASE_BRANCH"
 
   create-pr:
-    needs: bump-version
+    needs:
+      - validate-version
+      - bump-version
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v6
       - name: create pull request
-        uses: repo-sync/pull-request@v2
+        # repo-sync/pull-request v2.12.1, checked 2026-04-26.
+        uses: repo-sync/pull-request@7e79a9f5dc3ad0ce53138f01df2fad14a04831c5
         with:
-          source_branch: "release/v${{ inputs.cli-version }}"
+          source_branch: "release/v${{ needs.validate-version.outputs.validated-cli-version }}"
           destination_branch: "master"
-          pr_title: "release/v${{ inputs.cli-version }}"
+          pr_title: "release/v${{ needs.validate-version.outputs.validated-cli-version }}"
           pr_body: "Open automatically using bump version workflow"
           github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/cleanup-stale-schemas.yml

@@ -0,0 +1,100 @@
+name: Cleanup stale CI schemas
+
+on:
+  schedule:
+    # Daily at 03:00 UTC
+    - cron: "0 3 * * *"
+  workflow_dispatch:
+    inputs:
+      max-age-hours:
+        type: string
+        required: false
+        default: "24"
+        description: Drop schemas older than this many hours
+
+permissions: {}
+
+env:
+  # Re-use the dbt-data-reliability integration-test project so we get the
+  # cleanup macro (drop_stale_ci_schemas) without duplicating it.
+  TESTS_DIR: ${{ github.workspace }}/dbt-data-reliability/integration_tests
+
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    strategy:
+      fail-fast: false
+      matrix:
+        warehouse-type:
+          - snowflake
+          - bigquery
+          - redshift
+          - databricks_catalog
+          - athena
+    steps:
+      - name: Configure AWS credentials
+        if: matrix.warehouse-type == 'athena'
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_OIDC_ROLE_ARN }}
+          aws-region: eu-west-1
+
+      - name: Checkout dbt package
+        uses: actions/checkout@v6
+        with:
+          repository: elementary-data/dbt-data-reliability
+          # Pinned to dbt-data-reliability master HEAD at update time (2026-04-27).
+          # Refresh intentionally when updating cleanup macro behavior.
+          ref: ea58f5331e334d3a6774cc90f91f299b9929dada
+          path: dbt-data-reliability
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.10"
+          cache: "pip"
+
+      - name: Install dbt
+        run: >
+          pip install
+          "dbt-core"
+          "dbt-${{ (matrix.warehouse-type == 'databricks_catalog' && 'databricks') || (matrix.warehouse-type == 'athena' && 'athena-community') || matrix.warehouse-type }}"
+
+      - name: Write dbt profiles
+        env:
+          CI_WAREHOUSE_SECRETS: ${{ secrets.CI_WAREHOUSE_SECRETS || '' }}
+        run: |
+          if [ -z "$CI_WAREHOUSE_SECRETS" ]; then
+            echo "::error::Missing required secret: CI_WAREHOUSE_SECRETS"
+            exit 1
+          fi
+          # The cleanup job doesn't create schemas, but generate_profiles.py
+          # requires --schema-name.  Use a dummy value.
+          python "${{ github.workspace }}/dbt-data-reliability/integration_tests/profiles/generate_profiles.py" \
+            --template "${{ github.workspace }}/dbt-data-reliability/integration_tests/profiles/profiles.yml.j2" \
+            --output ~/.dbt/profiles.yml \
+            --schema-name "cleanup_placeholder"
+
+      - name: Install dbt deps
+        working-directory: ${{ env.TESTS_DIR }}/dbt_project
+        run: dbt deps
+
+      - name: Symlink local elementary package
+        run: ln -sfn ${{ github.workspace }}/dbt-data-reliability ${{ env.TESTS_DIR }}/dbt_project/dbt_packages/elementary
+
+      - name: Drop stale CI schemas
+        working-directory: ${{ env.TESTS_DIR }}/dbt_project
+        env:
+          MAX_AGE_HOURS: ${{ inputs.max-age-hours || '24' }}
+        run: |
+          if ! [[ "$MAX_AGE_HOURS" =~ ^[0-9]+$ ]]; then
+            echo "::error::max-age-hours must be a non-negative integer"
+            exit 1
+          fi
+          ARGS=$(printf '{"prefixes":["py_"],"max_age_hours":%s}' "$MAX_AGE_HOURS")
+          dbt run-operation drop_stale_ci_schemas \
+            --args "$ARGS" \
+            -t "${{ matrix.warehouse-type }}"

.github/workflows/close_pylon_issue.yml

@@ -0,0 +1,37 @@
+name: Close Pylon Ticket on Issue or Pull Request Closure
+
+on:
+  issues:
+    types: [closed]
+  pull_request_target:
+    types: [closed]
+
+permissions: {}
+
+jobs:
+  close_pylon_ticket:
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Extract Pylon Ticket ID
+        id: extract_ticket_id
+        env:
+          EVENT_BODY: ${{ github.event_name == 'issues' && github.event.issue.body || github.event.pull_request.body }}
+        run: |
+          pylon_ticket_id=$(echo "$EVENT_BODY" | grep -oP '(?<=<!-- pylon-ticket-id: )\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b(?= -->)')
+          echo "pylon_ticket_id=$pylon_ticket_id" >> "$GITHUB_OUTPUT"
+
+      - name: Close Pylon Ticket
+        if: steps.extract_ticket_id.outputs.pylon_ticket_id != ''
+        env:
+          PYLON_TICKET_ID: ${{ steps.extract_ticket_id.outputs.pylon_ticket_id }}
+          PYLON_API_KEY: ${{ secrets.PYLON_API_KEY }}
+        run: |
+          echo "Closing Pylon Ticket ID: $PYLON_TICKET_ID"
+          curl --request PATCH \
+            --url "https://api.usepylon.com/issues/$PYLON_TICKET_ID" \
+            --header "Authorization: $PYLON_API_KEY" \
+            --header 'Content-Type: application/json' \
+            --data '{
+              "state": "closed"
+            }'