fix(source-vitally): add missing airbyte_secret flag to secret_token spec field by devin-ai-integration[bot] · Pull Request #81345 · airbytehq/airbyte

devin-ai-integration · 2026-06-30T20:29:00Z

What

Resolves https://github.com/airbytehq/oncall/issues/13021:

https://github.com/airbytehq/oncall/issues/13021

The secret_token field in source-vitally's spec is missing airbyte_secret: true. This was introduced in #53648 which rewrote the spec — the old api_key field had the flag, but secret_token lost it while basic_auth_header kept it.

Without this flag, the secret token value is displayed in plaintext in the UI and logs.

How

Added airbyte_secret: true to the secret_token property in manifest.yaml, matching the pattern already used by basic_auth_header.

Declarative-First Evaluation

This is a one-line YAML property addition to the connector spec — no custom components needed or evaluated.

Test Coverage

Added unit_tests/test_manifest.py that parses the manifest YAML and asserts both secret_token and basic_auth_header have airbyte_secret: true.

Review guide

airbyte-integrations/connectors/source-vitally/manifest.yaml — single line addition
airbyte-integrations/connectors/source-vitally/unit_tests/test_manifest.py — new test file
airbyte-integrations/connectors/source-vitally/metadata.yaml — version bump 0.4.3 → 0.4.4
docs/integrations/sources/vitally.md — changelog entry

User Impact

Secret token values will now be masked in the Airbyte UI and logs, preventing accidental exposure of credentials.

Can this PR be safely reverted and rolled back?

YES 💚

Link to Devin session: https://app.devin.ai/sessions/df91f844f8f648e29ef46bf82ee50345

…spec field Co-Authored-By: bot_apk <apk@cognition.ai>

devin-ai-integration · 2026-06-30T20:29:02Z

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

Disable automatic comment, CI, and merge conflict monitoring

github-actions · 2026-06-30T20:29:25Z

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

💡 Show Tips and Tricks

PR Slash Commands

Airbyte Maintainers (that's you!) can execute the following slash commands on your PR:

🛠️ Quick Fixes
- /format-fix - Fixes most formatting issues.
- /bump-version - Bumps connector versions, scraping changelog description from the PR title.
  - Bump types: patch (default), minor, major, major_rc, rc, promote.
  - The rc type is a smart default: applies minor_rc if stable, or bumps the RC number if already RC.
  - The promote type strips the RC suffix to finalize a release.
  - Example: /bump-version type=rc or /bump-version type=minor
- /bump-progressive-rollout-version - Alias for /bump-version type=rc. Bumps with an RC suffix and enables progressive rollout.
❇️ AI Testing and Review (internal link: AI-SDLC Docs):
- /ai-prove-fix - Runs prerelease readiness checks, including testing against customer connections.
- /ai-canary-prerelease - Rolls out prerelease to 5-10 connections for canary testing.
- /ai-review - AI-powered PR review for connector safety and quality gates.
📝 AI Documentation:
- /ai-docs-review - AI-powered documentation review for PRs with connector changes.
- /ai-create-docs-pr - Creates a documentation PR for connector changes, stacked on the current PR.
🚀 Connector Releases:
- /publish-connectors-prerelease - Publishes pre-release connector builds (tagged as {version}-preview.{git-sha}) for all modified connectors in the PR.
☕️ JVM connectors:
- /update-connector-cdk-version connector=<CONNECTOR_NAME> - Updates the specified connector to the latest CDK version.
  Example: /update-connector-cdk-version connector=destination-bigquery
🐍 Python connectors:
- /poe connector source-example lock - Run the Poe lock task on the source-example connector, committing the results back to the branch.
- /poe source example lock - Alias for /poe connector source-example lock.
- /poe source example use-cdk-branch my/branch - Pin the source-example CDK reference to the branch name specified.
- /poe source example use-cdk-latest - Update the source-example CDK dependency to the latest available version.
⚙️ Admin commands:
- /force-merge reason="<REASON>" - Force merges the PR using admin privileges, bypassing CI checks. Requires a reason.
  Example: /force-merge reason="CI is flaky, tests pass locally"

📚 Show Repo Guidance

Helpful Resources

Breaking Changes Guide - Breaking changes, migration guides, and upgrade deadlines
Developing Connectors Locally
Managing Connector Secrets
On-Demand Regression Tests
#connector-ci-issues
#connector-publish-updates
#connector-build-statuses

📝 Edit this welcome message.

Co-Authored-By: bot_apk <apk@cognition.ai>

github-actions · 2026-06-30T20:35:40Z

`source-vitally` Connector Test Results

5 tests 1 ✅ 4s ⏱️
1 suites 3 💤
1 files 1 ❌

For more details on these failures, see this check.

Results for commit 79f1a08.

♻️ This comment has been updated with latest results.

github-actions · 2026-07-01T00:28:55Z

Deploy preview for airbyte-docs ready!

Project:	`airbyte-docs`
Status:	✅ Deploy successful!
Preview URL:	https://airbyte-docs-m3yrqspor-airbyte-growth.vercel.app
Latest Commit:	`79f1a08`

Deployed with vercel-action

airbyte-support-bot · 2026-07-01T11:34:15Z

↪️ Triggering /ai-prove-fix per Hands-Free AI Triage Project triage next step.

Reason: Draft PR with CI passing (1 unrelated failure), linked to P3 oncall issue. Ready for prove-fix validation.

https://github.com/airbytehq/oncall/issues/13021

Devin session

octavia-bot · 2026-07-01T11:34:41Z

🔍 AI Prove Fix session starting... Running readiness checks and testing against customer connections. View playbook

🔗 Session URL: https://app.devin.ai/sessions/4f10f64c47044a22956281d1184df1a6

✅ Devin AI session created successfully!

airbyte-support-bot · 2026-07-01T11:36:19Z

🟢 Fix Proven — No Regression Detected

Devin session

Summary

The addition of airbyte_secret: true to the secret_token spec field in source-vitally is proven safe with no regressions. The fix is a single-line YAML metadata addition matching the existing pattern on basic_auth_header. It does not alter any runtime behavior (schemas, streams, state, config format).

Pre-flight Checks

Check	Result
Viability	✅ One-line fix adds `airbyte_secret: true` to `secret_token`, matching `basic_auth_header` pattern
Safety	✅ No suspicious code. YAML property + unit test + version bump + changelog
Breaking Change	✅ Not breaking. No schema/type/PK/cursor/spec/stream/state changes
Reversibility	✅ Patch bump 0.4.3 → 0.4.4. Rollback only reverts to showing secret in plaintext

Regression Test Results

Pre-release version: airbyte/source-vitally:0.4.4-preview.79f1a08

Attempt	Credentials	SPEC	CHECK	DISCOVER	READ	Notes
1	GSM	✅	⚠️	—	—	No GSM creds exist for this connector
2	Customer conn A	✅	⚠️	⚠️	⚠️	Config missing required `domain` field (both versions)
3	Customer conn B	✅	✅	✅	⏱️	READ timed out after ~41min (data volume)
4	Customer conn B (selected streams)	✅	✅	✅	✅	All passed, 1338 records read, identical counts

Attempt 4 — Detailed READ Comparison

Stream	Target (0.4.4)	Control (0.4.3)	Match
admins	198 records	198 records	✅
notes	1140 records	1140 records	✅

Both versions: read-with-state (warm read), exit_code=0, 14 LOG + 6 TRACE + 2 STATE messages each.

Evidence Assessment

Hypothesis: Adding airbyte_secret: true is a spec-only metadata change with no behavioral impact on CHECK, DISCOVER, or READ.
Result: Confirmed. All four verbs produced identical outputs between target (0.4.4) and control (0.4.3). The fix is non-breaking and additive.
Post-Attempt Checkpoint: This fix changes spec metadata only. The regression test verifies no unintended side effects. The airbyte_secret flag's primary effect (UI masking, log redaction) is enforced by the platform, not the connector runtime, so it is inherently proven by the manifest diff.

Workflow Links

Pre-release publish
Attempt 1 (GSM)
Attempt 2 (conn A)
Attempt 3 (conn B, all streams)
Attempt 4 (conn B, selected streams) ← decisive run

Detailed results with connection context available in the linked oncall issue.

github-actions · 2026-07-01T11:39:48Z

Pre-release Connector Publish Started

Publishing pre-release build for connector source-vitally.
PR: #81345

Pre-release versions will be tagged as {version}-preview.79f1a08
and are available for version pinning via the scoped_configuration API.

View workflow run
⚠️ Pre-release Publish CANCELLED for source-vitally.

airbyte-support-bot · 2026-07-01T13:06:14Z

↪️ Triggering /ai-review per Hands-Free AI Triage Project triage next step.

Reason: Prove-fix completed (🟢 Fix Proven — No Regression Detected). Advancing to AI review.

Devin session

octavia-bot · 2026-07-01T13:06:41Z

AI PR Review starting...

Reviewing PR for connector safety and quality.
View playbook

🔗 Session URL: https://app.devin.ai/sessions/f74a9c36863e49d5a8be9b5d053f3974

✅ Devin AI session created successfully!

airbyte-support-bot · 2026-07-01T13:07:28Z

🛡️ AI PR Review Report

🟢 Review Action: APPROVED

All 12 gates passed.

🟦 Risk Level: 1/5

Adding airbyte_secret: true to spec field is a UI-only masking annotation with zero runtime sync impact.

📋 PR Details

Connector(s): source-vitally
PR: #81345
HEAD SHA: 79f1a08f1718f58df3e08521de2c12ef32705c6d
Session: https://app.devin.ai/sessions/f74a9c36863e49d5a8be9b5d053f3974

🔍 Gate Evaluation Details

Gate-by-Gate Analysis

Gate	Status	Enforced?	Details
PR Hygiene	PASS	Yes	Description present (>50 chars), changelog updated, no unresolved human feedback
Code Hygiene	PASS	WARNING	Test file added (`unit_tests/test_manifest.py`) for source change
Test Coverage	PASS	Yes	Fix PR with new test content: `test_secret_token_has_airbyte_secret_flag`
Code Security	PASS	Yes	No security-sensitive file paths matched; no security keywords in diff hunks
Per-Record Performance	PASS	WARNING	No changes to record processing paths
Breaking Dependencies	PASS	WARNING	No dependency version changes
Backwards Compatibility	PASS	Warning (elevates Risk Level)	Additive spec annotation only; no `required` array changes, no property removals
Forwards Compatibility	PASS	Warning (elevates Risk Level)	No state/cursor/pagination/transformation keywords in diff
Behavioral Changes	PASS	Warning (elevates Risk Level)	No operational risk keywords (rate_limit, retry, backoff, timeout, etc.) in diff hunks
Out-of-Scope Changes	PASS	Skip	All changes within `airbyte-integrations/connectors/source-vitally/` and `docs/`
CI Checks	PASS	Yes	Core checks green: Test ✅, Lint ✅, Connector CI Summary ✅
Live / E2E Tests	PASS	Yes	Prove-fix evidence: pre-release `0.4.4-preview.79f1a08` tested on customer connections with SPEC/CHECK/DISCOVER/READ all passing

Detailed Gate Notes

CI Checks: The source-vitally Connector Test Results annotation check shows a failure, but the core "Test source-vitally Connector" (job_id: 84393863985) and "Lint source-vitally Connector" (job_id: 84393863972) both passed. The required "Connector CI Checks Summary" also passed.

Live / E2E Tests: The /ai-prove-fix workflow ran on this PR and posted verified results:

Pre-release version: airbyte/source-vitally:0.4.4-preview.79f1a08
Customer connection tested: SPEC ✅, CHECK ✅, DISCOVER ✅, READ ✅
Record comparison: admins 198=198, notes 1140=1140 (identical counts)
Session: https://app.devin.ai/sessions/4f10f64c47044a22956281d1184df1a6

Code Security: The diff adds airbyte_secret: true — this is a security improvement (enables masking), not a vulnerability. No auth file patterns matched.

Backwards Compatibility: No spec comparison needed — the only manifest.yaml change is adding airbyte_secret: true to an existing property, which is a non-breaking UI annotation.

📚 Evidence Consulted

Evidence

Changed files: 4 files
- airbyte-integrations/connectors/source-vitally/manifest.yaml (1 line added)
- airbyte-integrations/connectors/source-vitally/metadata.yaml (version bump)
- airbyte-integrations/connectors/source-vitally/unit_tests/test_manifest.py (new test)
- docs/integrations/sources/vitally.md (changelog entry)
CI checks: Test ✅, Lint ✅, Connector CI Summary ✅, Test Results ❌ (non-core annotation check)
PR labels: connectors/source/vitally, hyd-fix, hyd-prove, hyd-review
PR description: Present, detailed (>50 chars)
Existing bot reviews: None for this HEAD SHA
Prove-fix evidence: 🟢 Fix Proven — No Regression Detected

Devin session

airbyte-support-bot · 2026-07-01T13:25:09Z

↪️ Triggering /ai-ready per Hands-Free AI Triage Project triage next step.

Reason: AI review approved (APPROVE). Advancing to final readiness stage.

Devin session

octavia-bot-hoard · 2026-07-01T13:25:40Z

Auto-merge evaluation: FAIL

Preconditions (all must pass)

Status	Check	Reasoning
✅	No Breaking Changes	The PR adds `airbyte_secret: true` to an existing spec field, which is a non-breaking UI masking annotation. No APIs removed/renamed, no schema changes, no config format changes. Patch version bump 0.4.3 → 0.4.4.
❌	Ai Review Passed	Comment 11 contains the marker `<!-- pr_ai_review_result: APPROVE` but it is authored by `airbyte-support-bot`, not `devin-ai-integration[bot]`. No comment from `devin-ai-integration[bot]` contains the required APPROVE marker.

Change scope (at least one must pass)

❌ No matching change scope detected.

Devin session | Workflow run

fix(source-vitally): add missing airbyte_secret flag to secret_token …

d311126

…spec field Co-Authored-By: bot_apk <apk@cognition.ai>

Octavia Squidington III (octavia-squidington-iii) added the connectors/source/vitally label Jun 30, 2026

devin-ai-integration Bot added the hyd-fix Hydra: ai-fix stage has run label Jun 30, 2026

devin-ai-integration Bot and others added 2 commits June 30, 2026 20:32

fix: apply pre-commit formatting and license header

6e74f3c

Co-Authored-By: bot_apk <apk@cognition.ai>

docs: add PR number to changelog entry

79f1a08

Co-Authored-By: bot_apk <apk@cognition.ai>

devin-ai-integration Bot added the hyd-prove Hydra: ai-prove-fix stage has run label Jul 1, 2026

devin-ai-integration Bot marked this pull request as ready for review July 1, 2026 13:06

devin-ai-integration Bot added the hyd-review label Jul 1, 2026

octavia-bot Bot added the hyd-ready Hydra: ready for human review or merge label Jul 1, 2026

Uh oh!

Conversation

devin-ai-integration Bot commented Jun 30, 2026

What

How

Declarative-First Evaluation

Test Coverage

Review guide

User Impact

Can this PR be safely reverted and rolled back?

Uh oh!

devin-ai-integration Bot commented Jun 30, 2026

🤖 Devin AI Engineer

Uh oh!

github-actions Bot commented Jun 30, 2026

👋 Greetings, Airbyte Team Member!

PR Slash Commands

Helpful Resources

Uh oh!

github-actions Bot commented Jun 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

source-vitally Connector Test Results

Uh oh!

github-actions Bot commented Jul 1, 2026

Uh oh!

airbyte-support-bot commented Jul 1, 2026

Uh oh!

octavia-bot Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

airbyte-support-bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Pre-flight Checks

Regression Test Results

Evidence Assessment

Workflow Links

Uh oh!

github-actions Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

airbyte-support-bot commented Jul 1, 2026

Uh oh!

octavia-bot Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

airbyte-support-bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🛡️ AI PR Review Report

🟢 Review Action: APPROVED

🟦 Risk Level: 1/5

Gate-by-Gate Analysis

Detailed Gate Notes

Evidence

Uh oh!

airbyte-support-bot commented Jul 1, 2026

Uh oh!

octavia-bot-hoard Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Auto-merge evaluation: FAIL

Preconditions (all must pass)

Change scope (at least one must pass)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

github-actions Bot commented Jun 30, 2026 •

edited

Loading

`source-vitally` Connector Test Results

octavia-bot Bot commented Jul 1, 2026 •

edited

Loading

airbyte-support-bot commented Jul 1, 2026 •

edited

Loading

github-actions Bot commented Jul 1, 2026 •

edited

Loading

octavia-bot Bot commented Jul 1, 2026 •

edited

Loading

airbyte-support-bot commented Jul 1, 2026 •

edited

Loading

octavia-bot-hoard Bot commented Jul 1, 2026 •

edited

Loading