gabrielmoreira Clari CI Integration
Overview
Add Clari export validation to CI: test API connectivity, validate export schemas, and run pipeline integration tests.
Prerequisites
- Protected CI environment with scoped, masked secrets
- Mock fixtures for pull-request tests and an approved integration test account
- A repository environment gate for any production-targeted job
- Retention policy for generated logs and artifacts
Instructions
GitHub Actions Workflow
name: Clari Pipeline Tests
on:
push:
paths: ["src/clari/**", "tests/clari/**"]
schedule:
- cron: "0 6 * * 1" # Weekly Monday check
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5
with:
python-version: "3.11"
- run: pip install -r requirements.txt
- name: Unit tests (mock data)
run: pytest tests/ -v -k "not integration"
- name: Integration test (real API)
if: github.ref == 'refs/heads/main'
env:
CLARI_API_KEY: ${{ secrets.CLARI_API_KEY }}
run: |
python -c "
from clari_client import ClariClient
client = ClariClient()
forecasts = client.list_forecasts()
assert len(forecasts) > 0, 'No forecasts found'
print(f'Connected: {len(forecasts)} forecasts available')
"
- name: Schema validation
env:
CLARI_API_KEY: ${{ secrets.CLARI_API_KEY }}
run: |
python scripts/validate_schema.py
Store Secrets
gh secret set CLARI_API_KEY --body "your-api-token"
Error Handling
| Condition | Response |
|---|---|
| Unit fixture or schema test fails | Fail the run before any external request and attach a redacted report. |
| Integration account cannot authenticate | Stop retries, verify the secret reference and account scope, then notify its owner. |
| Export shape changes | Quarantine the release and require a reviewed schema migration. |
| Secret appears in logs or artifacts | Revoke it, purge according to policy, and investigate exposure. |
Output
Publish a redacted run summary with fixture/integration status, schema version, external job IDs, artifact retention location, and promotion decision. Secrets, forecast payloads, and download URLs must remain masked and unavailable to untrusted pull-request code.
Examples
Run mock tests on every pull request, then run one read-only integration export only from a protected branch using a scoped environment secret. Fail closed if the schema changes or the credential is unavailable; a successful read does not authorize a data load or production deployment.
Resources
Next Steps
For deployment patterns, see clari-deploy-integration.