DataHub-powered pull request governance
LineageGate turns DataHub lineage and governance evidence into deterministic GitHub Checks, commit-bound approvals, actionable remediation, and a durable decision trail.
The governance blind spot
A deleted column may affect dashboards, owned datasets, quality checks, and consumers that never appear in the pull request. LineageGate brings that catalog context into the merge decision without letting generated text decide policy.
How it works
Compare validated base and head dbt manifests.
Map changed models and columns to DataHub assets.
Evaluate typed policy over a frozen evidence envelope.
Bind approval to the current SHA, read back, and audit.
Verified end-to-end evidence
Every product image below comes from the same sanitized signed-webhook run. No screenshot was generated or reconstructed for presentation.
The pull request removes a field and establishes the exact commit under review.
Incomplete or unsafe evidence becomes an explicit blocked result, never a guess.
A remediation commit creates a new run; approval for the earlier SHA cannot carry forward.
Current-commit approval and re-verification update the existing Check to success.
LineageGate saves the final decision to DataHub and compares immutable fields before green.
Persisted runs, approvals, effects, and events reconstruct what happened and why.
Architecture
The model adapter is optional and bounded to grounded explanations. It cannot override policy or directly mutate GitHub or DataHub.
Run the verified project
The repository includes source, Docker-based local services, migrations, fixtures, tests, the final video project, and sanitized evidence.
corepack enable
pnpm install --frozen-lockfile
pnpm format:check
pnpm lint
pnpm typecheck
pnpm test:unit
pnpm test:contract
pnpm buildLive scripts require scoped GitHub and DataHub credentials.
Truthful scope
Signed webhook handling, evidence acquisition, fail-closed policy, SHA-bound approval, Check updates, DataHub write/readback, restart recovery, and durable audit.
A hardened hosted runtime, multi-runner lease renewal, broader artifact acquisition, and configurable organization policy packs.