From 9fb976ce84dc02452f22765dea03397ef3cd612e Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Thu, 8 Oct 2026 22:18:56 +0000
Subject: [PATCH 1/2] fix(sdm): precompile dependency bytecode in the
 source-declarative-manifest image

Co-Authored-By: bot_apk <apk@cognition.ai>
---
 .github/workflows/docker-build-check.yml | 41 ++++++++++++++++++++++++
 Dockerfile                               |  5 +++
 2 files changed, 46 insertions(+)

diff --git a/.github/workflows/docker-build-check.yml b/.github/workflows/docker-build-check.yml
index 0cc3036c4b..f20e6e8b85 100644
--- a/.github/workflows/docker-build-check.yml
+++ b/.github/workflows/docker-build-check.yml
@@ -45,6 +45,47 @@ jobs:
           tags: airbyte/source-declarative-manifest:pr-${{ github.event.pull_request.number }}
           outputs: type=image,name=target,annotation-index.org.opencontainers.image.description=SDM Docker image for PR ${{ github.event.pull_request.number }}
 
+      - name: Build Docker image for bytecode check (linux/amd64)
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          platforms: linux/amd64
+          load: true
+          tags: airbyte/source-declarative-manifest:bytecode-check
+
+      - name: Verify every site-packages module has precompiled bytecode
+        run: |
+          docker run --rm -i --entrypoint python airbyte/source-declarative-manifest:bytecode-check - <<'EOF'
+          import importlib.util
+          import pathlib
+          import struct
+          import sys
+          import sysconfig
+
+          root = pathlib.Path(sysconfig.get_paths()["purelib"])
+          missing, stale = [], []
+          total = 0
+          for src in root.rglob("*.py"):
+              total += 1
+              pyc = pathlib.Path(importlib.util.cache_from_source(str(src)))
+              if not pyc.is_file():
+                  missing.append(src)
+                  continue
+              header = pyc.read_bytes()[:16]
+              flags = int.from_bytes(header[4:8], "little")
+              if header[:4] != importlib.util.MAGIC_NUMBER:
+                  stale.append(src)
+              elif flags == 0:
+                  mtime, size = struct.unpack("<II", header[8:16])
+                  st = src.stat()
+                  if (mtime, size) != (int(st.st_mtime) & 0xFFFFFFFF, st.st_size & 0xFFFFFFFF):
+                      stale.append(src)
+          print(f"{root}: {total} .py files, {len(missing)} without .pyc, {len(stale)} with stale .pyc")
+          for path in (missing + stale)[:20]:
+              print(f"  {path}")
+          sys.exit(1 if total == 0 or missing or stale else 0)
+          EOF
+
   manifest-server-docker-build-check:
     name: Manifest Server Docker Image Build
     runs-on: ubuntu-24.04
diff --git a/Dockerfile b/Dockerfile
index d9eb986295..b4dff3d936 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -20,6 +20,11 @@ RUN poetry config virtualenvs.create false \
 # Build and install the package
 RUN pip install dist/*.whl
 
+# Precompile bytecode for all installed packages. `poetry install` does not compile it, and the
+# runtime `airbyte` user cannot write to the root-owned site-packages, so without this every
+# connector process recompiles its dependencies on start. Fails the build if any file fails to compile.
+RUN python -m compileall -q -j 0 /usr/local/lib/python3.13/site-packages
+
 # Recreate the original structure
 RUN mkdir -p source_declarative_manifest \
     && echo 'from source_declarative_manifest.run import run\n\nif __name__ == "__main__":\n    run()' > main.py \

From 6574c476341f128705df86af01e7efc7f316a23b Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 21 Oct 2026 21:51:32 +0000
Subject: [PATCH 2/2] fix(sdm): warn on compile failures, reject unvalidatable
 .pyc, skip test dirs

Co-Authored-By: bot_apk <apk@cognition.ai>
---
 .github/workflows/docker-build-check.yml | 9 +++++++--
 Dockerfile                               | 9 +++++----
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/docker-build-check.yml b/.github/workflows/docker-build-check.yml
index f20e6e8b85..52c90a2353 100644
--- a/.github/workflows/docker-build-check.yml
+++ b/.github/workflows/docker-build-check.yml
@@ -58,14 +58,19 @@ jobs:
           docker run --rm -i --entrypoint python airbyte/source-declarative-manifest:bytecode-check - <<'EOF'
           import importlib.util
           import pathlib
+          import re
           import struct
           import sys
           import sysconfig
 
+          SKIP = re.compile(r"/tests?/")  # keep in sync with compileall -x in the Dockerfile
+
           root = pathlib.Path(sysconfig.get_paths()["purelib"])
           missing, stale = [], []
           total = 0
           for src in root.rglob("*.py"):
+              if SKIP.search(str(src)):
+                  continue
               total += 1
               pyc = pathlib.Path(importlib.util.cache_from_source(str(src)))
               if not pyc.is_file():
@@ -73,9 +78,9 @@ jobs:
                   continue
               header = pyc.read_bytes()[:16]
               flags = int.from_bytes(header[4:8], "little")
-              if header[:4] != importlib.util.MAGIC_NUMBER:
+              if len(header) < 16 or header[:4] != importlib.util.MAGIC_NUMBER or flags != 0:
                   stale.append(src)
-              elif flags == 0:
+              else:
                   mtime, size = struct.unpack("<II", header[8:16])
                   st = src.stat()
                   if (mtime, size) != (int(st.st_mtime) & 0xFFFFFFFF, st.st_size & 0xFFFFFFFF):
diff --git a/Dockerfile b/Dockerfile
index b4dff3d936..dfa79fcad5 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -20,10 +20,11 @@ RUN poetry config virtualenvs.create false \
 # Build and install the package
 RUN pip install dist/*.whl
 
-# Precompile bytecode for all installed packages. `poetry install` does not compile it, and the
-# runtime `airbyte` user cannot write to the root-owned site-packages, so without this every
-# connector process recompiles its dependencies on start. Fails the build if any file fails to compile.
-RUN python -m compileall -q -j 0 /usr/local/lib/python3.13/site-packages
+# Precompile bytecode for installed packages, skipping test directories. `poetry install` does not
+# compile it, and the runtime `airbyte` user cannot write to the root-owned site-packages, so without
+# this every connector process recompiles its dependencies on start.
+RUN python -m compileall -q -j 0 -x '/tests?/' /usr/local/lib/python3.13/site-packages \
+    || echo "WARNING: some files failed to compile (see errors above); continuing without their bytecode"
 
 # Recreate the original structure
 RUN mkdir -p source_declarative_manifest \