[Daryna Ishchenko (darynaishchenko)]

Summary

Closes the third CI gap that let #1076 ship the #1082 regression without any check going red: the Docker image tests always built connector images FROM the already-published SDM base image from metadata.yaml, so the PR branch's CDK was never inside the container. A second gap compounded it — a failing in-container check exits 0 and only reports CONNECTION_STATUS: FAILED, which the harness never asserted on.

Three changes:

1. Base-image override, plumbed end to end — build a connector image FROM an arbitrary (e.g. locally built, unpublished) SDM image:

   build_connector_image(..., base_image_override=...)   # utils/docker.py
   airbyte-cdk image build/test --base-image <image>     # cli/_image.py
   pytest --connector-base-image <image>                 # pytest_hooks.py -> connector_base_image_override fixture -> docker_base.py
   

   base_image_override or metadata.data.connectorBuildOptions.baseImage — metadata remains the default when the flag is absent.

2. The existing "Test Connectors" matrix now tests the branch's CDK inside the container. For manifest-only connectors (source-intercom, source-pokeapi), the matrix job builds airbyte/source-declarative-manifest:dev from the current branch and runs image test --base-image with it — previously those container tests ran the already-released CDK from the published base image, so they couldn't catch a CDK regression pre-release. Python connectors already get the branch CDK in their images: the Bump to Dev Branch CDK step pins the connector's CDK dependency to the branch ref, which the container image's poetry install then picks up.

3. test_docker_image_build_and_check now asserts the check outcome — previously a check returning CONNECTION_STATUS: FAILED (exit code 0, no trace error) passed the test. Now the reported outcome must match the scenario in both directions: scenarios expecting success must report Status.SUCCEEDED, scenarios expecting failure must not report SUCCEEDED (previously those were skipped entirely, so an expected-to-fail check that started succeeding in-container went unnoticed), and scenarios with no declared status map to ALLOW_ANY and keep their either-outcome-passes contract. The assertion logic lives in an _assert_check_outcome helper with unit tests covering the full expected-outcome × reported-status matrix.

Verified locally with the exact CI command:

• base image = published SDM 7.23.7 (the fix(declarative): require AIRBYTE_ENABLE_UNSAFE_CODE to instantiate Custom* components from YAML #1076 CDK): test_docker_image_build_and_check fails — check reports Custom connector code is not permitted in this environment.
• base image = SDM built from a branch carrying the fix(declarative): allow bundled custom components without AIRBYTE_ENABLE_UNSAFE_CODE #1083 fix: all image tests pass.

Also adds a parametrized unit test asserting base_image_override is threaded into the BASE_IMAGE build arg (and that metadata remains the default). The test runs against a tmp_path copy of the pokeapi fixture with Dockerfile-template resolution stubbed, so it is hermetic: no network fallback and no writes into the checked-in fixture directory.

FAST standard tests also use the branch SDM base

The Run FAST Standard Tests [Manifest-Only Connectors] step also collects the docker image tests (test_docker_image_build_and_{spec,check,read}), which previously built the connector image FROM the published metadata base image — duplicating each image test against the released CDK and preventing layer reuse with the later image test step. The SDM build step now runs before it, and the FAST step passes --pytest-arg=--connector-base-image --pytest-arg=airbyte/source-declarative-manifest:dev, so both steps build FROM the branch-built SDM image. This is also the path that exercises the new pytest --connector-base-image option and connector_base_image_override fixture.

Also fixes a pre-existing crash in airbyte-cdk connector test: --pytest-arg (click multiple=True) yields a tuple, so combining it with --collect-only or --no-creds raised AttributeError: 'tuple' object has no attribute 'append'.

CI state

While #1083 was unmerged, the matrix container test for source-intercom (bundled components.py) correctly failed on this PR with Custom connector code is not permitted in this environment — proving the guard catches the #1082 regression when the branch-built SDM carries it. Now that #1083 is merged and this branch is updated with main, that check passes.

Note: the new check-outcome assertion also surfaced that destination-motherduck's in-container check has been silently failing in CI (MotherDuck token auth error + a PermissionError), previously masked because the harness ignored CONNECTION_STATUS: FAILED. That looks like a connector-secrets/environment issue, independent of this PR's code.

Summary by CodeRabbit

• New Features
  • Added an optional --base-image override for connector image build and test flows.
  • CI now treats manifest-only connectors specially by building and using a local development base image for their connector tests and image checks.
• Tests
  • Extended connector Docker checks to assert successful connection status progression (not just container exit codes).
  • Added unit and pytest coverage for default vs overridden base-image selection.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

💡 Show Tips and Tricks

Testing This CDK Version

You can test this version of the CDK using the following:

# Run the CLI from this branch:
uvx 'git+https://github.com/airbytehq/airbyte-python-cdk.git@devin/1785245034-ci-image-test-branch-cdk#egg=airbyte-python-cdk[dev]' --help

# Update a connector to use the CDK from this branch ref:
cd airbyte-integrations/connectors/source-example
poe use-cdk-branch devin/1785245034-ci-image-test-branch-cdk

PR Slash Commands

Airbyte Maintainers can execute the following slash commands on your PR:

• /autofix - Fixes most formatting and linting issues
• /poetry-lock - Updates poetry.lock file
• /test - Runs connector tests with the updated CDK
• /prerelease - Triggers a prerelease publish with default arguments
• /poe build - Regenerate git-committed build artifacts, such as the pydantic models which are generated from the manifest JSON schema in YAML.
• /poe <command> - Runs any poe command in the CDK environment

📚 Show Repo Guidance

Helpful Resources

• CDK API Reference

📝 Edit this welcome message.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The change adds optional base-image overrides to Docker image builds, CLI commands, and standard tests. Docker check tests now validate emitted connection statuses, and CI builds and uses a local declarative-manifest image for manifest-only connector tests.

Changes

Custom Base Image Testing

Layer / File(s)	Summary
Base image override contract and build wiring airbyte_cdk/utils/docker.py, airbyte_cdk/cli/airbyte_cdk/_image.py, unit_tests/utils/test_docker_build.py	build_connector_image selects an explicit override when provided, CLI build and test commands forward --base-image, and unit tests cover override and metadata fallback behavior.
Standard test integration airbyte_cdk/test/standard_tests/pytest_hooks.py, airbyte_cdk/test/standard_tests/docker_base.py, airbyte_cdk/cli/airbyte_cdk/_connector.py	Pytest exposes --base-image to Docker tests, which pass the override through image builds and assert that check output ends with Status.SUCCEEDED; connector test arguments are normalized to a list.
Manifest-only CI testing .github/workflows/connector-tests.yml	CI builds airbyte/source-declarative-manifest:dev for manifest-only connectors and passes it to connector and container tests; other connectors retain the default image-test path.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant AirbyteCDK
  participant Docker
  GitHubActions->>Docker: Build airbyte/source-declarative-manifest:dev
  GitHubActions->>AirbyteCDK: Run connector or image test with --base-image
  AirbyteCDK->>Docker: Build connector image using the local base image
  AirbyteCDK->>Docker: Run connector check
  Docker-->>AirbyteCDK: Return connection status messages

Loading

Suggested reviewers: girarda, pnilan, aaronsteers

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: CI now tests connector images against a branch-built SDM base image.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch devin/1785245034-ci-image-test-branch-cdk

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/connector-tests.yml:
- Around line 228-231: Update the “Checkout CDK” actions/checkout step to set
persist-credentials to false, ensuring the checkout token is not retained in Git
configuration while preserving the existing full-history checkout.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0e4c8ffd-b176-4751-a11b-724cd5b0157a

📥 Commits

Reviewing files that changed from the base of the PR and between 7e96546 and 909c48b.

📒 Files selected for processing (6)

• .github/workflows/connector-tests.yml
• airbyte_cdk/cli/airbyte_cdk/_image.py
• airbyte_cdk/test/standard_tests/docker_base.py
• airbyte_cdk/test/standard_tests/pytest_hooks.py
• airbyte_cdk/utils/docker.py
• unit_tests/utils/test_docker_build.py

[github-actions]

PyTest Results (Fast)

4 158 tests  +19   4 146 ✅ +19   7m 42s ⏱️ -7s
    1 suites ± 0      12 💤 ± 0 
    1 files   ± 0       0 ❌ ± 0 

Results for commit d58c80a. ± Comparison against base commit 6ce33ea.

♻️ This comment has been updated with latest results.

[github-actions]

PyTest Results (Full)

4 161 tests  +19   4 149 ✅ +19   8m 17s ⏱️ - 4m 9s
    1 suites ± 0      12 💤 ± 0 
    1 files   ± 0       0 ❌ ± 0 

Results for commit d58c80a. ± Comparison against base commit 6ce33ea.

♻️ This comment has been updated with latest results.