Column-Level Lineage Diff on GitLab

Set up Column-Level Lineage Diff on GitLab. First complete the shared Lineage Diff prerequisites. Then choose how it runs:

With the GitLab connection (recommended): Paradime runs Lineage Diff after Turbo CI on each merge request. You do not need a pipeline or an access token.
From a GitLab pipeline: your .gitlab-ci.yml runs Turbo CI, then asks Paradime for the lineage diff report and posts it.

Run Lineage Diff with the GitLab connection

Prerequisites

Connect GitLab on gitlab.com or GitLab Self-Managed, and pick your dbt™ project as one of the connection’s projects.
Set up Turbo CI with the GitLab connection.

A GitLab pipeline for a merge request commit, with an external stage that holds the Paradime Lineage Diff and Paradime Turbo CI statuses, both passed

When Turbo CI starts on a merge request commit, the Paradime Lineage Diff commit status shows as pending. The first Turbo CI run on that commit that produces a dbt™ manifest computes the diff. If columns changed, Paradime posts one note on the merge request that lists the impacted downstream nodes. On each new commit, Paradime updates the same note instead of adding a new one. If the Turbo CI run is cancelled, for example by a new push, the commit’s Paradime Lineage Diff status shows as cancelled instead of waiting.

Run Lineage Diff from a GitLab pipeline

Generate API keys

Generate a Paradime API key with the Bolt schedules admin capability. Use an Account API key (a prdm_cmp_... Bearer token), and note your workspace token and API endpoint; you will add them as CI/CD variables in a later step.

Generate API keys

Create a Pipeline

Now you will need to create a new .gitlab-ci.yml file in your dbt™️ repository. Copy the code below. This pipeline has two stages:

paradime_turbo_ci — Runs the Turbo CI bolt schedule and exports the BOLT_RUN_ID for the next stage.
lineage_diff_report — Uses the BOLT_RUN_ID to trigger the lineage diff report and posts the result as a comment on the Merge Request.

stages:
  - paradime_turbo_ci
  - lineage_diff_report

paradime_turbo_ci:
  stage: paradime_turbo_ci
  image: python:3.11
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      when: always
  variables:
    PARADIME_SCHEDULE_SLUG: "flowing-pachy-wyy4fs"
  before_script:
    - pip install paradime-io
  script:
    - echo "Merge Request Number: $CI_MERGE_REQUEST_IID"
    - echo "Commit SHA: $CI_COMMIT_SHA"
    - |
      python3 -u << 'EOF'
      import os
      import time
      from paradime import Paradime
      from paradime.apis.bolt.types import BoltRunState

      paradime = Paradime(
        workspace_uid=os.environ['PARADIME_WORKSPACE_UID'],
        api_secret=os.environ['PARADIME_API_SECRET'],
        api_endpoint=os.environ['PARADIME_API_ENDPOINT']
      )

      run_id = paradime.bolt.trigger_run(
        slug=os.environ['PARADIME_SCHEDULE_SLUG'],
        branch=os.environ['CI_COMMIT_SHA'],
        pr_number=int(os.environ['CI_MERGE_REQUEST_IID']),
      )
      print(f"Bolt Run ID: {run_id}")

      # Poll until the Bolt run reaches a terminal state so the CI job
      # reflects the actual run result
      while True:
        run_status = paradime.bolt.get_run_status(run_id)
        print(f"Status: {run_status}")
        if run_status in (
          BoltRunState.SUCCESS,
          BoltRunState.ERROR,
          BoltRunState.FAILED,
          BoltRunState.CANCELED,
          BoltRunState.SKIPPED,
        ):
          break
        time.sleep(30)

      with open("bolt.env", "w") as f:
        f.write(f"BOLT_RUN_ID={run_id}\n")

      if run_status != BoltRunState.SUCCESS:
        raise SystemExit(f"Bolt run {run_id} finished with state: {run_status}")
      EOF
  artifacts:
    reports:
      dotenv: bolt.env
  timeout: 60 minutes

lineage_diff_report:
  stage: lineage_diff_report
  image: python:3.11
  needs:
    - job: paradime_turbo_ci
      artifacts: true
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
      when: always
  variables:
    GIT_DEPTH: 0
  before_script:
    - pip install paradime-io
  script:
    - echo "Bolt Run ID: $BOLT_RUN_ID"
    - echo "Pull Request Number: $CI_MERGE_REQUEST_IID"
    - echo "Pull Request Author Email: $GITLAB_USER_EMAIL"
    - export CHANGED_FILES=$(git diff --name-only $CI_MERGE_REQUEST_DIFF_BASE_SHA $CI_COMMIT_SHA)
    - echo "Files changed in this MR:"; echo "$CHANGED_FILES"
    - export REPORT_FILE="report_$(openssl rand -hex 12).json"
    - python3 -u <<EOF
      import os
      import json
      from pathlib import Path
      from paradime import Paradime
      paradime = Paradime(
        workspace_uid=os.environ['PARADIME_WORKSPACE_UID'],
        api_secret=os.environ['PARADIME_API_SECRET'],
        api_endpoint=os.environ['PARADIME_API_ENDPOINT']
      )
      report = paradime.lineage_diff.trigger_report_and_wait(
        bolt_run_id=int(os.environ['BOLT_RUN_ID']),
        pull_request_number=int(os.environ['CI_MERGE_REQUEST_IID']),
        user_email=os.environ['GITLAB_USER_EMAIL'],
        changed_file_paths=os.environ['CHANGED_FILES'].split('\n'),
      )
      print("Lineage Diff Report Message:", report.message)
      if report.result_markdown:
        data = json.dumps({'body': report.result_markdown})
        Path(os.environ['REPORT_FILE']).write_text(data)
      EOF
    - |
      if [ -f "$REPORT_FILE" ]; then
        COMMENT_BODY=$(cat "$REPORT_FILE")
        curl --request POST --header "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
          --header "Content-Type: application/json" \
          --data "$COMMENT_BODY" \
          "https://gitlab.com/api/v4/projects/${CI_PROJECT_ID}/merge_requests/${CI_MERGE_REQUEST_IID}/notes"
      else
        echo "Report file not found, skipping comment."
      fi
  timeout: 60 minutes

Create a GitLab Access Token

You will need to create GitLab Access Token with API to enable Comments to be generated when opening a Merge Request. Create a group access token (Only available on GitLab Premium Tier or Higher) Navigate to your GitLab project

Go to Settings > Access Tokens in the left sidebar
Enter a name for your token (e.g., “API Comment Access”)
Select the appropriate scopes:
- api (for general API access)
- Specifically for comments, you’ll need at least api scope, which includes the ability to write comments

Create a GitLab personal access token

If using a GitLab personal access token, we suggest creating a new user, called “Paradime” and create the access token attached to this user.

Go to your user profile > Preferences > Access Tokens (or navigate to https://gitlab.com/-/profile/personal_access_tokens)
Enter a name for your token (e.g., “API Comment Access”)
Select the appropriate scopes:
- api (for general API access)
- Specifically for comments, you’ll need at least api scope, which includes the ability to write comments

Add the API key and Credential in the GitLab variables

Finally you need to add the API key and Credentials generated in the previous step in GitLab CI/CD settings (not in the .gitlab-ci.yml file directly). Set the corresponding values for the following variable names:

PARADIME_WORKSPACE_UID
PARADIME_API_SECRET
PARADIME_API_ENDPOINT
GITLAB_TOKEN

Schedule Anatomy

Deploy Schedules

Managing Schedules

CI/CD

Column-Level Lineage Diff on GitLab

Run Lineage Diff with the GitLab connection

Run Lineage Diff from a GitLab pipeline

Generate API keys

Generate API keys

Create a Pipeline

Create a GitLab Access Token

Add the API key and Credential in the GitLab variables

​Run Lineage Diff with the GitLab connection

​Run Lineage Diff from a GitLab pipeline

​Generate API keys

Generate API keys

​Create a Pipeline

​Create a GitLab Access Token

​Add the API key and Credential in the GitLab variables

Run Lineage Diff with the GitLab connection

Run Lineage Diff from a GitLab pipeline

Generate API keys

Create a Pipeline

Create a GitLab Access Token

Add the API key and Credential in the GitLab variables