Live artifact checks
Gated suites that assert real Databricks artifacts — SQL warehouses, UC grants, Delta contracts, DLT pipelines, Jobs, Lakebase — and emit audit evidence.
Status: Available in part (Phase 3). The gated runner, JSON/JUnit evidence, SQL, Delta-contract, Unity Catalog allow/deny, and Jobs checks ship today. Auto Loader, notebook-submit, Lakebase pool-refresh, and dbt checks remain planned.
The live tier runs against a real workspace, is always gated (silent no-op
without DBX_TEST_LIVE=1), and produces evidence you can hand to an auditor.
The check runner
import { defineLiveSuite } from '@fabricorg/databricks-testkit'
const suite = defineLiveSuite({
required: ['sql', 'uc-grants', 'delta-contract'],
checks: [
sqlRoundTripCheck(),
unityCatalogAccessCheck(),
deltaContractCheck('DBX_TEST_DELTA_TABLE', [
{ name: 'experiment_id', type: 'string' },
]),
jobRunCheck(),
],
})Each check reports pass | fail | not-configured with durations; required
checks gate the exit code, optional ones inform. Output is a schema-versioned,
secret-redacted evidence JSON plus JUnit XML for CI annotation.
Built-in checks
| Check | Asserts |
|---|---|
sqlRoundTripCheck | Statement Execution API round-trip on a warehouse |
unityCatalogAccessCheck | allowed SELECT succeeds, denied SELECT raises permission error |
deltaContractCheck | table schema matches the committed contract |
jobRunCheck | run reaches SUCCESS within budget |
Auto Loader E2E, notebook submit, Lakebase pool refresh, and dbt-build checks
remain Phase 3 follow-ons. Product-specific checks can already be registered with
customLiveCheck() and receive the shared evidence and required-check semantics.
Long-running checks use poll-to-terminal helpers with explicit timeouts and abort support — a hung pipeline fails the check rather than the CI job's global timeout.
Environment
DBX_TEST_LIVE=1
DATABRICKS_HOST=https://<workspace>.cloud.databricks.com
DATABRICKS_HTTP_PATH=/sql/1.0/warehouses/<id> # optional; discovered if unset
# auth: one of
DATABRICKS_BEARER=... # CI (pre-minted M2M token)
DATABRICKS_CLIENT_ID=... DATABRICKS_CLIENT_SECRET=...
DATABRICKS_TOKEN=... # PAT (local development)
DBX_TEST_CATALOG=fx_test # scratch catalog for scenario schemasCI wiring
A nightly workflow (databricks-live.yml) uses OAuth M2M credentials through the
testkit's cached token provider, runs the live suite and product BDD features,
uploads the evidence JSON as an artifact, and alerts Slack on failure. It joins
the existing live-smoke gates as m6; see
docs/runbooks/live-smoke.md.
Cost controls: serverless SQL warehouse with auto-stop, scenario-scoped scratch
schemas dropped in teardown, and @slow checks confined to the nightly run.