Tags: GoCodeAlone/workflow-plugin-data-engineering

v0.3.3 — release-pipeline fix (goreleaser YAML escape)

v0.3.2 — workflow v0.64.0 dep bump (picks up contract-diff + lockfile…

… dep tracking + verify-capabilities)

chore: bump plugin.json version at release time

Add sed before-hook to goreleaser so plugin.json "version" field is
rewritten to the release tag at release time. Version injection into
the binary via `-X main.version` was already correct.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

fix: code review — 5 security issues resolved

CRITICAL:
- Validate transform expressions in expand-contract trigger SQL
  (reject semicolons, DDL keywords in PL/pgSQL function body)
- Validate table names, tenant_column, schema_prefix in tenant
  promotion/demotion SQL (ident.Validate on all interpolated identifiers)

MEDIUM:
- Validate ClickHouse engine, orderBy, partitionBy in materialized
  view DDL (regex + keyword blocklist)
- Validate measurement name in ClickHouse tier-status system.parts query
- Validate LLM entity types against safe token regex before prompt injection

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

feat: extend testhelpers with quality module and executor helpers

Adds QualitySetExecutor, QualityNewModuleWithExecutor, and DBQuerier
type alias so external test suites can inject mock SQL executors into
quality.checks modules without importing internal packages.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

feat: add testhelpers package for external test suite access

Exports thin wrappers around internal registry functions and mock
constructors so workflow-scenarios/e2e can run full lifecycle tests
without importing internal packages directly.

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>

fix: code quality review — 5 security + correctness issues resolved

CRITICAL:
- Validate SQL column types + defaults against whitelists in declarative differ
- Validate Cypher labels, relationship types, and property keys against
  identifier regex in all graph step builders (steps.go + knowledge.go)

MODERATE:
- Add sync.RWMutex to contractDBRegistry in catalog/contract_validate.go
- Validate lockTable in NewMigrationRunner (not just in EnsureLockTable)

MINOR:
- profiler.go error swallow noted (deferred to follow-up)

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>