test(downstream): run DataHub Git integration for its latest release

Complete the five-current-user compatibility matrix with `acryl-datahub`.
Resolve the latest PyPI release and retrieve its tag from `acryldata/datahub`,
which publishes patch tags missing from the repository named by package
metadata. Run the unchanged Git integration file against the installed
release and this editable GitPython checkout.

Exclude unrelated SQL/docker conftests, disable telemetry, and clear the
private SSH test credential variable. The selected tests still exercise a
real public GitLab clone and fixed-commit checkout, a localhost SSH timeout,
GitCommandError handling, password redaction, and source configuration.
The upstream private-clone test retains its credential-dependent skip.

Document all five current users and their September 2026 download ranking,
including optional runtime integrations, distribution deduplication, and
projects whose latest releases dropped GitPython. Add an all-project local
command and the fifth CI matrix entry.

The shared runner passes 7 tests with 1 upstream skip for DataHub 1.7.0.14
on Python 3.12 and Git 2.54. All five profiles have now passed locally,
with 68 upstream passes plus 4 SWE-bench supplemental cases. Ruff, Python
syntax, workflow YAML/matrix consistency, Bash syntax, ShellCheck, and
whitespace checks pass. No GitPython compatibility fixes were required.

Also clear inherited pytest options and plugins: a caller's `-k` filter
could otherwise leave only unrelated contract tests and yield a misleading
pass. All four SWE-bench cases still pass with a deliberately nonmatching
inherited filter and a nonexistent plugin, verifying their removal.

Author: codex

.github/workflows/downstream.yml

@@ -16,7 +16,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        project: [langchain, mlflow, bandit, swebench]
+        project: [langchain, mlflow, bandit, swebench, datahub]
     steps:
       - uses: actions/checkout@v7
         with:

test/downstream/README.md

@@ -6,6 +6,9 @@ Run released projects' GitPython-related tests against this checkout with
 ```sh
 uv run test/downstream/run.py bandit
 uv run test/downstream/run.py bandit --version 1.9.4
+for project in langchain mlflow bandit swebench datahub; do
+    uv run test/downstream/run.py "$project"
+done
 ```
 
 The default resolves the latest release from PyPI each time. `--version` reproduces
@@ -19,8 +22,9 @@ elsewhere. Delete retained directories when no longer needed. PyPI source archiv
 are verified against their published SHA-256 digest and extracted with Python's
 safe data filter. Each run uses a private Git configuration, including an identity
 and the `master` initial branch expected by upstream fixtures. Inherited Git
-settings and Python import paths are cleared before setup and testing. Select a
-different Git executable by putting its directory first on `PATH`.
+settings, pytest options/plugins, and Python import paths are cleared before
+setup and testing. Select a different Git executable by putting its directory
+first on `PATH`.
 
 ## Selection and coverage
 
@@ -34,12 +38,16 @@ and test-only dependencies are excluded. Downloads are not unique installations.
 | MLflow (`mlflow-skinny`) | 25,850,354 | 3.16.1 | 47 upstream tests: 31 repository/project/model-versioning cases plus 16 Git context and credential-redaction contract cases |
 | Bandit | 24,935,372 | 1.9.4 | 12 upstream baseline CLI tests: real repository creation, commits, branches, resets, discovery, and dirty state |
 | SWE-bench | 22,942,741 | 5.0.2 | 4 supplemental integration cases for `AutoContextManager`; no upstream tests cover its GitPython callers |
+| DataHub (`acryl-datahub`) | 5,019,402 | 1.7.0.14 | 7 upstream tests passed, 1 credential-dependent skip: public clone/checkout, SSH timeout, exception/redaction contracts, and configuration |
 
 Source: [top-pypi-packages](https://hugovk.github.io/top-pypi-packages/top-pypi-packages.min.json),
 snapshot updated **2026-10-01 12:40:51 UTC**. Its
-[ClickHouse query](https://github.com/hugovk/top-pypi-packages/blob/main/top-pypi-clickhouse.py)
+[ClickHouse query](https://github.com/hugovk/top-pypi-packages/blob/main/clickhouse.py)
 covers the previous calendar month. Current metadata for the top 5,000
 distributions was checked, together with known runtime integrations.
+Streamlit and W&B are excluded because their latest releases removed GitPython.
+The next eligible declared consumer is `dlt` (5,002,981 downloads); LangChain's
+current runtime integration places it in the selected five instead.
 
 LangChain Community's published `GitLoader` integration uses GitPython at runtime
 and asks users to install it manually. It qualifies as a current user even though
@@ -76,6 +84,16 @@ The supplemental filename is intentionally excluded from GitPython's normal test
 collection; the runner selects it explicitly with importlib mode to avoid
 shadowing the upstream `swebench` package.
 
+DataHub uses GitPython in its `looker`, `lookml`, and `odcs` runtime extras.
+Patch-release tags come from `acryldata/datahub`, although its package metadata
+links to a different repository. The Git integration file runs without unrelated
+SQL/docker conftests; telemetry is disabled explicitly. It clones a public GitLab
+fixture and checks out a fixed commit, exercises a real localhost SSH timeout,
+and checks exception handling, password redaction, and URL/branch configuration.
+The private SSH-clone test retains its upstream skip: the runner removes its
+credential variable and needs no private credentials. `ssh`, public GitLab
+access, and local TCP sockets are needed for the selected tests.
+
 CI runs the same command against the latest release and fails when no test passes,
 including when all selected tests are skipped. Test dependency ranges only supply
 the upstream test harness; they do not pin the dependent's release.

test/downstream/projects.json

@@ -49,5 +49,17 @@
     "no_deps": ["{source}"],
     "pytest_args": ["--confcutdir={checks}", "--import-mode=importlib"],
     "tests": ["{checks}/swebench.py"]
+  },
+  "datahub": {
+    "distribution": "acryl-datahub",
+    "source": "git",
+    "repository": "https://github.com/acryldata/datahub.git",
+    "tag": "v{version}",
+    "cwd": "metadata-ingestion",
+    "install": ["acryl-datahub=={version}", "pytest"],
+    "unset_env": ["DATAHUB_LOOKML_GIT_TEST_SSH_KEY"],
+    "env": {"DATAHUB_TELEMETRY_ENABLED": "false"},
+    "pytest_args": ["--confcutdir=tests/integration/git"],
+    "tests": ["tests/integration/git/test_git_clone.py"]
   }
 }

test/downstream/run.py

@@ -110,7 +110,8 @@ def main():
     )
     # Do not let inherited Git settings redirect upstream resets or commits into
     # the caller's repository, index, object database, configuration, or hooks.
-    env = {key: value for key, value in os.environ.items() if not key.startswith("GIT_")}
+    # Inherited pytest options/plugins must not replace the selected coverage.
+    env = {key: value for key, value in os.environ.items() if not key.startswith(("GIT_", "PYTEST_"))}
     env.pop("PYTHONPATH", None)
     env.pop("PYTHONHOME", None)
     env.update(GIT_CONFIG_GLOBAL=str(config), GIT_CONFIG_NOSYSTEM="1", GIT_TERMINAL_PROMPT="0")