OpenMetadata/.github/workflows
IceS2 84ed278720
chore(ingestion): enable basedpyright across the codebase via baseline (#27755)
* chore(ingestion): enable basedpyright across the codebase via baseline

Removes the ~25 paths from `[tool.basedpyright] ignore` (which excluded
roughly 90% of the codebase from type checking) and grandfathers the
existing violations into a baseline file. New violations in any
previously-ignored file now fail CI.

Changes:
- ingestion/pyproject.toml: drop the entire `ignore = [...]` block
- ingestion/setup.py: bump `basedpyright~=1.14` to `~=1.39.0`
- ingestion/.basedpyright/baseline.json (new, ~13MB): captures the
  starting violation set (~18.8K errors + ~37.4K warnings) so the
  migration is behavior-preserving. Regenerate with
  `cd ingestion && basedpyright -p pyproject.toml --baselinefile
  .basedpyright/baseline.json --writebaseline`. basedpyright analysis
  has minor non-determinism (similar to ruff's), so re-running
  --writebaseline a few times converges the baseline.
- ingestion/noxfile.py: pass `--baselinefile .basedpyright/baseline.json`
  to the basedpyright invocation in the `static-checks` session so CI
  honors the grandfathering. CI already runs the session via
  `cd ingestion && nox --no-venv -s static-checks` (py-tests.yml).
- ingestion/Makefile: `make static-checks` now delegates to
  `nox -s static-checks` so local invocations match CI exactly. Also
  drops the dead Python 3.9 / OM_SKIP_SDK_PY39 branch (we require
  Python >=3.10 since the previous modernization PR).
- .gitignore: add `.serena/` (local language-server cache)

* chore(ingestion): add nox to the dev dependency set

The static-checks Makefile target and the py-tests CI job both delegate
to `nox -s static-checks`, but nox was being installed as a separate
side step (`pip install nox` in `install_dev_env`, `uv pip install nox`
in the test-environment composite action). Listing it in dev extras
means a plain `pip install ingestion[dev]` brings it in.

* chore(ingestion): pin basedpyright analysis to py3.10; CI runs once

Following the basedpyright + multi-Python-version research:

- ingestion/pyproject.toml: add `pythonVersion = "3.10"` to
  [tool.basedpyright] so type-checking always analyzes for the lowest
  supported Python version. Forward-incompatible code (tomllib usage,
  PEP 695 generics, etc.) is caught at type-check time regardless of
  which Python interpreter runs the checker.
- .github/workflows/py-tests.yml: gate the "Run Static Checks" step on
  `matrix.py-version == '3.10'`. With pythonVersion pinned, results are
  identical across the matrix; running once avoids redundant work and
  keeps the baseline file deterministic. Unit tests still run on the
  full 3.10/3.11/3.12 matrix to verify runtime compatibility.
- ingestion/.basedpyright/baseline.json: regenerated cleanly with the
  new pythonVersion config (~18.8K errors / ~37.3K warnings, similar
  scale to the previous baseline). Aligns with the canonical
  type-check-on-floor / test-on-matrix pattern used by Pydantic, CPython,
  and other major Python projects.

* chore(ingestion): pin basedpyright pythonPlatform to Linux + regen baseline

CI's previous run still surfaced ~9 issues (2 errors + 7 warnings) that
weren't in the baseline. Root cause: my local environment differs from
CI's in three ways that affect type inference — Python interpreter
(3.11 vs 3.10), platform (Darwin vs Linux), and pip-resolved package
versions (couchbase, avro, trino, sqlalchemy stubs all differ slightly).

This commit closes the platform gap and regenerates the baseline from a
fresh CI-equivalent environment:

- ingestion/pyproject.toml: add `pythonPlatform = "Linux"` to
  [tool.basedpyright] so type-checking uses the Linux subset of stdlib /
  third-party stubs regardless of where the analyzer runs.
- ingestion/.basedpyright/baseline.json: regenerated against a fresh
  Python 3.10 venv installed via `uv pip install ingestion[test]` (the
  same install path CI's setup-openmetadata-test-environment composite
  action uses). New scale: ~18.7K errors / ~37.5K warnings — same
  ballpark as the previous baseline, with column positions now matching
  CI's environment.

Local-developer note: when running `make static-checks` from a venv
that doesn't mirror CI exactly (e.g. macOS, Python 3.11, different
package versions), you may see drift errors. The supported workflow for
regenerating the baseline is to mirror CI:
  python3.10 -m venv /tmp/ci-mirror
  source /tmp/ci-mirror/bin/activate
  uv pip install --upgrade pip "setuptools<81"
  uv pip install --no-build-isolation "cx_Oracle>=8.3.0,<9"
  uv pip install -e "ingestion[test]"
  uv pip install "basedpyright~=1.39.0" nox
  cd ingestion && basedpyright -p pyproject.toml \
      --baselinefile .basedpyright/baseline.json --writebaseline

* chore(ingestion): drop pythonPlatform pin and regen baseline from CI-mirror

The previous attempt added `pythonPlatform = "Linux"` thinking it would
make the local-generated baseline match CI. It did the opposite — Linux
platform stubs activate additional conditional code paths that weren't
analyzed before, so CI saw 101 errors instead of the prior 2 errors.

Reverting:
- Drop `pythonPlatform = "Linux"` from [tool.basedpyright]. Without it,
  basedpyright analyzes for the host platform; on CI's ubuntu-latest
  runner that's Linux automatically, but type-stub coverage stays the
  same as before (matching the d9196dff6b baseline).
- Regenerate ingestion/.basedpyright/baseline.json against a fresh
  Python 3.10 venv installed via `uv pip install ingestion[test]`
  (mirroring CI's setup-openmetadata-test-environment composite action).
  ~18.8K errors / 37.7K warnings captured — same scale as the working
  d9196dff6b version.

Local-developer note: any baseline regeneration done on macOS will drift
from CI's Linux env (different transitive package versions, different
stubs). The supported local mirror procedure:
  python3.10 -m venv /tmp/ci-mirror
  source /tmp/ci-mirror/bin/activate
  uv pip install --upgrade pip "setuptools<81"
  uv pip install --no-build-isolation "cx_Oracle>=8.3.0,<9"
  uv pip install -e "ingestion[test]"
  uv pip install "basedpyright~=1.39.0" nox
  cd ingestion && basedpyright -p pyproject.toml \\
      --baselinefile .basedpyright/baseline.json --writebaseline

* chore(ingestion): regen baseline from full CI install (mac arm64 mirror)

Prior CI-mirror only installed [test], skipping [all] and the four
--no-deps SA pins (sqlalchemy-redshift/databricks/ibmi, pydoris-custom).
That left ~75 connector packages out of the analysis env, so basedpyright
couldn't resolve types from databricks.sqlalchemy, GE 0.18 Batch,
sklearn BaseEstimator, airflow SQLAlchemy models, pandas/numpy stubs,
etc. CI saw 129 errors absent from the baseline.

Regenerated against a fresh py3.10 venv that mirrors
.github/actions/setup-openmetadata-test-environment exactly:
  uv pip install ./ingestion[dev]
  make generate
  uv pip install "setuptools<81"
  uv pip install --no-build-isolation "cx_Oracle>=8.3.0,<9"
  uv pip install --no-deps sqlalchemy-redshift==0.8.14 \
                            sqlalchemy-databricks==0.2.0 \
                            sqlalchemy-ibmi==0.9.3 \
                            pydoris-custom==1.1.0
  uv pip install ./ingestion[all]
  uv pip install ./ingestion[test]
  uv pip install nox

First run: 128 errors, 272 warnings — within 1 error of CI's 129/272.
Wrote baseline with 56,100 entries across 1,035 files. Verify run with
the new baseline reports 0/0/0.

macOS arm64 vs Linux x86_64 wheel resolution may leave a small residual
(~3-7 errors per the d9196dff6b precedent). Re-run --writebaseline 2-3x
if any show up in CI.

* chore(ingestion): silence avro.py:95 basedpyright residual

CI's Linux fastavro stub returns Schema as `str | List[Any]`, while
the macOS arm64 wheel narrows to `str` — the only error not absorbed
by the regenerated baseline. Add a targeted pyright: ignore on the
parse_avro_schema call instead of broadening behavior.

* chore(ingestion): tolerate cross-platform pyright ignore drift

CI's `--baselinemode=lock` (default) requires the baseline to match
exactly — neither up nor down. Two related issues:

1. The avro.py noqa silenced not just the surfaced error but 10
   cascading entries at line 95 (sub-errors propagating from the
   unresolved `schema` arg type). Baseline went `down by 10` → lock
   violated → exit 3 even with `0 errors` reported. Regenerate baseline
   so the 10 stale entries are dropped.

2. The macOS arm64 fastavro stub doesn't surface that error in the
   first place, so basedpyright treats the noqa as
   `reportUnnecessaryTypeIgnoreComment` locally — causing the opposite
   lock mismatch on CI (a warning entry that doesn't exist there).
   Disable the rule so platform-specific residuals can land without
   flapping between local and CI.

* chore(ingestion): use --baselinemode=discard for cross-platform tolerance

CI's implicit default is `lock`, which fails on any baseline change in
either direction (errors going up *or* down) via console.error → exit 3.
That cannot accommodate macOS arm64 vs Linux x86_64 stub drift: a
baseline regenerated locally always carries some entries that don't fire
on CI (and vice versa).

`auto` would tolerate the drift but silently overwrites the baseline
file — unacceptable in CI, where unreviewed changes never get committed
back.

`discard` is the right balance:
  - New errors not in the baseline still fail the run (early-return path
    in BaselineHandler.write before the lock/discard branch).
  - Stale baseline entries (errors that no longer fire on the current
    platform) print an info message and exit 0.
  - The baseline file is never modified.
2026-04-27 17:15:44 +02:00
..
airflow-apis-tests.yml ci: reduce checkout history footprint in PR workflows (#27221) 2026-04-13 10:46:17 -07:00
auto-cherry-pick-labeled-prs.yaml chore: updating auto cherry pick wf (#19264) 2025-01-07 11:54:31 +01:00
claude.yml Add Claude Code GitHub Workflow (#22315) 2025-07-11 11:43:11 -07:00
codeql.yml Chore: Add codeql blank workflow (#23921) 2025-10-16 16:05:01 +05:30
docker-k8s-operator.yml FIX - K8s Operator Release CI (#25785) 2026-02-10 10:48:41 +01:00
docker-openmetadata-db.yml feat: Ingestion Docker Image Tags (#16819) 2024-06-27 18:40:06 +05:30
docker-openmetadata-ingestion-base-slim.yml fix: Do not Update Docker Image Tags (3 digits) on RC Releases (#17218) 2024-07-29 15:38:58 +05:30
docker-openmetadata-ingestion-base.yml fix: Add cleanup for runner (#25277) 2026-01-14 10:29:46 +05:30
docker-openmetadata-ingestion.yml HOTFIX: Docker Ingestion CI add free disk space step (#24491) 2025-11-21 18:55:17 +05:30
docker-openmetadata-postgres.yml feat: Ingestion Docker Image Tags (#16819) 2024-06-27 18:40:06 +05:30
docker-openmetadata-server.yml Fix #21506: Upgrade to Java 21 (#21507) 2025-06-11 22:06:08 -07:00
git-create-release-branch.yml fix: Update CI to add run-name, remove trivial steps, default_author: github_actions (#16456) 2024-05-29 15:56:50 +05:30
integration-tests-mysql-elasticsearch.yml MINOR - Enable merge group GH event (#27371) 2026-04-15 07:42:08 -07:00
integration-tests-postgres-opensearch.yml MINOR - Enable merge group GH event (#27371) 2026-04-15 07:42:08 -07:00
java-checkstyle.yml MINOR - Enable merge group GH event (#27371) 2026-04-15 07:42:08 -07:00
label-connector.yml chore(github): migrate issue templates to structured forms (#27710) 2026-04-24 14:08:20 +02:00
maven-build-collate.yml GEN-4896: Fix/ghsa head ref (#26861) 2026-03-30 10:48:12 -04:00
maven-sonar-build.yml GEN-4896: Fix/ghsa head ref (#26861) 2026-03-30 10:48:12 -04:00
monitor-slack-link.yml CI - Slack link monitor w/ playwright (#25641) 2026-01-30 10:23:52 +01:00
mysql-nightly-e2e.yml Fix: Playwright remove all browsers binaries vulnerability (#26959) 2026-04-06 11:00:29 +05:30
openmetadata-service-unit-tests.yml MINOR - Enable merge group GH event (#27371) 2026-04-15 07:42:08 -07:00
playwright-docs-check.yml Fix: Playwright remove all browsers binaries vulnerability (#26959) 2026-04-06 11:00:29 +05:30
playwright-integration-tests-mysql.yml Fix Metrics collection; reduce no.of metrics; improve slow request lo… (#25751) 2026-03-13 13:38:31 -07:00
playwright-integration-tests-postgres.yml Fix Metrics collection; reduce no.of metrics; improve slow request lo… (#25751) 2026-03-13 13:38:31 -07:00
playwright-knowledge-graph-postgresql-e2e.yml RDF, cleanup relations and remove unnecessary bindings, add distributed mode for RDF reindex (#26902) 2026-04-14 13:24:41 -07:00
playwright-mysql-e2e-skip.yml chore: Exclude playwright documentation and doc-generator paths from various CI workflow triggers. (#25568) 2026-01-28 05:12:03 +00:00
playwright-mysql-e2e.yml Fix: Playwright remove all browsers binaries vulnerability (#26959) 2026-04-06 11:00:29 +05:30
playwright-postgresql-e2e-skip.yml Add scripts path to skip file (#26934) 2026-04-01 18:31:15 +05:30
playwright-postgresql-e2e.yml MINOR - Enable merge group GH event (#27371) 2026-04-15 07:42:08 -07:00
playwright-sso-login-nightly.yml test(playwright): add nightly SSO login spec starting (#27164) 2026-04-17 13:09:54 +05:30
playwright-sso-tests.yml MSAL Token Renewal Fix — Safari Session Loss (#27214) 2026-04-09 17:45:00 -07:00
postgresql-nightly-e2e.yml Fix: Playwright remove all browsers binaries vulnerability (#26959) 2026-04-06 11:00:29 +05:30
publish-maven-package.yml Complete Migration to Central Publishing Portal (Replace Nexus Staging Plugin) (#24614) 2025-12-01 12:41:29 +05:30
py-checkstyle.yml MINOR - Enable merge group GH event (#27371) 2026-04-15 07:42:08 -07:00
py-cli-e2e-tests.yml fix: enable subprocess coverage tracking for CLI E2E tests (#27329) 2026-04-23 06:57:30 +02:00
py-operator-build-test.yml ci: reduce checkout history footprint in PR workflows (#27221) 2026-04-13 10:46:17 -07:00
py-sonarcloud-nightly.yml ci: reduce checkout history footprint in PR workflows (#27221) 2026-04-13 10:46:17 -07:00
py-tests-postgres.yml MINOR - Enable merge group GH event (#27371) 2026-04-15 07:42:08 -07:00
py-tests.yml chore(ingestion): enable basedpyright across the codebase via baseline (#27755) 2026-04-27 17:15:44 +02:00
python-packages-publish.yml MINOR: Fix Python Workflows (#20712) 2025-04-10 11:16:10 +05:30
security-scan.yml ci(security): add Retire.js workflow to detect bundled JS vulnerabilities (#27315) 2026-04-15 19:12:53 +05:30
stale.yml Stale pr workflow (#26667) 2026-03-20 14:18:33 -07:00
team-labeler.yml Update team-labeler action permissions (#21402) 2025-05-26 20:12:32 +02:00
trivy-scan-ingestion-base-slim-image.yml disable trivy scans from PR checks (#27017) 2026-04-06 15:00:30 +05:30
trivy-scan-ingestion-image.yml disable trivy scans from PR checks (#27017) 2026-04-06 15:00:30 +05:30
trivy-scan-openmetadata-server.yml disable trivy scans from PR checks (#27017) 2026-04-06 15:00:30 +05:30
typescript-type-generation.yml MINOR - Enable merge group GH event (#27371) 2026-04-15 07:42:08 -07:00
ui-checkstyle.yml Chore(UI): consolidated UI checkstyle fix commands and modify workflow comment (#27402) 2026-04-16 17:18:22 +05:30
update-playwright-e2e-docs.yml Potential fix for code scanning alert no. 1842: Artifact poisoning (#27220) 2026-04-10 16:12:28 +05:30
validate-docker-compose-quickstart.yml GEN-4784 Add validation action for OMD dockerfile (#24335) 2025-11-19 14:55:30 -05:00
validate-jsons-yamls.yml MINOR - Enable merge group GH event (#27371) 2026-04-15 07:42:08 -07:00
yarn-coverage.yml MINOR - Enable merge group GH event (#27371) 2026-04-15 07:42:08 -07:00