feat/tb-deploy

README still documents the old (now-wrong) %M minute format

infra/tinybird/README.md:52

The README's bucket_ts explanation still shows '%Y-%m-%dT%H:%M:%SZ' — the format that was just fixed to '%Y-%m-%dT%H:%i:%SZ'. A future reader following the README example for a new pipe will reintroduce the portability bug the pipe comment explicitly warns against. Update the README format string and add the one-line %M/%i note that lives in the pipe.

Stub test deletion is justified — test was for placeholder pipe, not real SQL

infra/tinybird/tests/resolve_stream_window.test.yaml

The deleted test expected a status='stub' column only valid for the placeholder pipe. The real pipe has completely different params and output shape. Keeping the stub test would cause tb test failures on every run. Deletion is correct; the gap is the absence of a replacement fixture for the real pipe.

Workspace Tinybird token written to GITHUB_OUTPUT without explicit masking

.github/workflows/preview-provision.yml:282

The tb_workspace_token output is written via shell variable expansion without a preceding '::add-mask::' call. Contrast with the branch token path (line 340) which explicitly masks before writing output. GitHub auto-masks values that flow through ${{ secrets.X }} expressions, but shell-expanded values may appear unmasked in workflow summaries or step references. Pre-existing pattern, but the diff's new documentation increases awareness of this token's role. Recommend adding echo '::add-mask::${TINYBIRD_TOKEN}' before line 282.

Other action tags in the same workflow files remain mutable (not introduced by this diff)

.github/workflows/staging-update.yml

The diff correctly SHA-pins dorny/paths-filter in preview-provision.yml and staging-update.yml. However, actions/checkout@v4, pnpm/action-setup@v3, aws-actions/configure-aws-credentials@v4, and others remain on mutable tags in the same files. The hardening is directionally correct but partial. A follow-up to pin the remaining third-party actions would complete it.

%i format fix is a correctness improvement that also reduces data-integrity risk

infra/tinybird/pipes/resolve_stream_window.pipe:107

On newer ClickHouse, %M renders the month name rather than the minute number, silently producing malformed ISO-8601 timestamps. parseTinybirdUtc provides a belt-and-suspenders filter, but the fix at the source is the right approach. No security concern; noted for completeness.

dorny/paths-filter SHA pinning is complete — pr-checks and release-promote don't use it

.github/workflows/preview-provision.yml

All three occurrences of dorny/paths-filter across the repo (2 in preview-provision.yml, 1 in staging-update.yml) are now SHA-pinned. pr-checks.yml and release-promote.yml do not use this action, so no additional pinning is needed for it.

quality field comments are in sync between datasource and pipe

infra/tinybird/datasources/metric.datasource:26

metric.datasource DESCRIPTION now matches resolve_stream_window.pipe raw_dedup DESCRIPTION: both document that quality is stored on ingest but not yet surfaced in the read path. The cross-reference and 'keep both ends in sync' instruction are clear and actionable.

No Tinybird pipe-level tests for the real resolve_stream_window pipe

infra/tinybird/tests/

After deleting the stub test, infra/tinybird/tests/ is empty. The real pipe covers three non-trivial nodes: raw_dedup (argMax dedup), priority_splice (argMin+indexOf source selection), and downsample (multiIf aggregator dispatch). None are covered by tb test fixtures. Schema changes or SQL regressions will only surface in production. At minimum, a happy-path fixture asserting the bucket_ts ISO-8601 shape and a two-source priority splice scenario should exist.

The %i format fix has no regression test at the pipe level

infra/tinybird/pipes/resolve_stream_window.pipe:107

The %M→%i change is a real portability bug fix (on newer ClickHouse %M renders the month name 'May' instead of the minute). The fix is correct, but there is no fixture asserting the bucket_ts output format (e.g. '2026-05-01T14:34:00Z'). If %i were ever reverted, no automated check would catch it before parseTinybirdUtc consumers receive malformed timestamps.

No deduplication test for argMax(value, ingested_at) in raw_dedup node

infra/tinybird/pipes/resolve_stream_window.pipe:36

The argMax deduplication is the mechanism that makes billing-grade late-arriving corrections self-heal. There is no fixture inserting two rows with the same (metric_source_id, ts) but different ingested_at values and asserting the later one wins. ReplacingMergeTree may or may not have collapsed duplicates at query time, making the explicit argMax layer especially important to test.

No test for priority_splice multi-source winner selection

infra/tinybird/pipes/resolve_stream_window.pipe:60

priority_splice picks the highest-precedence source at each timestamp via argMin(value, indexOf(ids[], metric_source_id)). This is the core business logic of priority splicing and has zero test coverage. A fixture with two sources sharing a timestamp should assert the first-array-position source wins.

No test for multiIf aggregator dispatch, especially the 'last' branch

infra/tinybird/pipes/resolve_stream_window.pipe:109

The downsample node dispatches five aggregators (sum/min/max/last/mean) via multiIf. The 'last' branch uses argMax(value, ts) which is semantically different from all others. No fixture validates that aggregator='last' returns the chronologically last value in a bucket rather than mean or sum.

quality sync note could add a cross-reference pointer from pipe back to datasource

infra/tinybird/pipes/resolve_stream_window.pipe:33

The pipe's raw_dedup says 'not exposed yet' without pointing to the datasource DESCRIPTION's more detailed sync note. Adding a brief pointer (e.g. 'see metric.datasource DESCRIPTION') would help future readers find the intent when adding the quality read path.