fix(low-code): preserve check config_overrides during parameter propagation

[devin-ai-integration]

This PR targets PR #1122:

• feat(low-code): let the check component override config values #1122

config_overrides only exists on that branch, so this fix cannot be based on main. It can be merged into #1122 or land immediately after it. If #1122 merges first, this will be retargeted to main.

---

Resolves https://github.com/airbytehq/airbyte-internal-issues/issues/16995:

• https://github.com/airbytehq/airbyte-internal-issues/issues/16995

Summary

check() reads config_overrides out of self._source_config, which is the post-transform manifest. ManifestComponentTransformer.propagate_types_and_parameters treats any nested mapping with a truthy type key as a component, so when a manifest puts $parameters on the check component and an override value is an object carrying a type field, the transformer injects the parameters plus a $parameters key into that object — and the mangled object is what gets overlaid onto the connector config during check.

check:
  type: CheckStream
  stream_names: ["items"]
  $parameters: {p: v}
  config_overrides:
    credentials: {type: oauth, client_id: x}

Before, the overlay applied at check time was:

{"credentials": {"type": "oauth", "client_id": "x", "p": "v", "$parameters": {"p": "v"}}}

The fix keeps the overrides out of the transformer's reach instead of teaching the shared transformer about field names (a field-name allowlist in ManifestComponentTransformer was explicitly rejected in the #1122 review thread — it would widen shared parser behaviour for a check-scoped feature). _pre_process_manifest now deep-copies the check's config_overrides between the two existing passes:

resolved_manifest = ManifestReferenceResolver().preprocess_manifest(manifest)
self._check_config_overrides = self._extract_check_config_overrides(resolved_manifest)  # new
propagated_manifest = ManifestComponentTransformer().propagate_types_and_parameters(...)

References are already resolved at that point, so a check behind a $ref is still found; parameters have not been propagated yet, so the values are still as authored. check() then uses self._check_config_overrides rather than check.get("config_overrides"). CheckDynamicStream is covered too, since the overlay is read from the check definition and is checker-agnostic.

Test Coverage

New test in unit_tests/sources/declarative/checks/test_check_stream.py: test_given_object_valued_config_override_when_check_then_parameters_are_not_injected_into_it. It puts $parameters on the check component and an object-valued override containing type, and has the stream echo the override object's keys into a query param, so the mocked request matches only if the object reached the stream exactly as authored. Verified it fails on this branch without the source change (assert_number_of_calls mismatch) and passes with it.

poetry run pytest unit_tests/sources/declarative/checks/test_check_stream.py -q   # 61 passed
poetry run pytest unit_tests/ -x -q
poetry run ruff check . && poetry run ruff format --check .                        # clean
poetry run mypy --config-file mypy.ini airbyte_cdk                                # clean

Declarative-First Evaluation

No custom Python component is involved, and no declarative feature can address this: the corruption happens in the shared manifest transformer before any component is built, so RecordFilter, transformations, or $ref overrides cannot prevent it. The fix stays in the check feature's own integration layer (ConcurrentDeclarativeSource), where the data is first read.

Breaking Change Evaluation

Not breaking. No schema, spec, stream, primary key, cursor, or state format changes; the change only preserves values already authored in config_overrides. This repo releases via semantic-pr-release-drafter, so no manual version bump or changelog edit is needed (fix: title drives a patch release).

Requested by Devin Bot via the /ai-fix workflow.

Link to Devin session: https://app.devin.ai/sessions/a9f68a5d7a5840dfa882111074154529

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

💡 Show Tips and Tricks

Testing This CDK Version

You can test this version of the CDK using the following:

# Run the CLI from this branch:
uvx 'git+https://github.com/airbytehq/airbyte-python-cdk.git@devin/1787224085-fix-check-config-overrides-parameters#egg=airbyte-python-cdk[dev]' --help

# Update a connector to use the CDK from this branch ref:
cd airbyte-integrations/connectors/source-example
poe use-cdk-branch devin/1787224085-fix-check-config-overrides-parameters

PR Slash Commands

Airbyte Maintainers can execute the following slash commands on your PR:

• /autofix - Fixes most formatting and linting issues
• /poetry-lock - Updates poetry.lock file
• /test - Runs connector tests with the updated CDK
• /prerelease - Triggers a prerelease publish with default arguments
• /poe build - Regenerate git-committed build artifacts, such as the pydantic models which are generated from the manifest JSON schema in YAML.
• /poe <command> - Runs any poe command in the CDK environment

📚 Show Repo Guidance

Helpful Resources

• CDK API Reference

📝 Edit this welcome message.

[Copilot]

Pull request overview

This PR fixes a low-code check() bug where config_overrides values (which are connector config objects, not declarative components) could be mutated during manifest parameter propagation when an override object contains a type field (e.g., OAuth credentials). The fix captures and deep-copies the check component’s config_overrides after $ref resolution but before ManifestComponentTransformer.propagate_types_and_parameters, and then uses that pristine copy when applying the check-time config overlay.

Changes:

• Extract and deep-copy check.config_overrides before parameter propagation mutates the manifest.
• Apply the check-time overlay from the extracted copy (instead of reading config_overrides from the propagated manifest).
• Add a regression unit test ensuring object-valued overrides containing type are not polluted with injected parameters.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
airbyte_cdk/sources/declarative/concurrent_declarative_source.py	Captures pristine config_overrides pre-propagation and uses it during check() config overlay to prevent parameter injection into override objects.
unit_tests/sources/declarative/checks/test_check_stream.py	Adds regression test that fails if parameter propagation injects keys into object-valued config_overrides entries with a type field.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

PyTest Results (Full)

4 286 tests   - 42   4 274 ✅  - 42   10m 23s ⏱️ -36s
    1 suites ± 0      12 💤 ± 0 
    1 files   ± 0       0 ❌ ± 0 

Results for commit ccf0557. ± Comparison against base commit 2639ce4.

[github-actions]

PyTest Results (Fast)

4 283 tests   - 42   4 272 ✅  - 42   10m 49s ⏱️ +29s
    1 suites ± 0      11 💤 ± 0 
    1 files   ± 0       0 ❌ ± 0 

Results for commit ccf0557. ± Comparison against base commit 2639ce4.