Data quality checks: warehouse "authentication failed" in CI

By Kaveh Alemi·Latchkey

The data quality tool reached the warehouse but authentication was rejected. The credentials (or the OIDC/keypair token) were missing, wrong, or not injected from CI secrets.

What this error means

dbt, Soda, or Great Expectations fails at connect time with "password authentication failed", "Invalid credentials", or an OIDC token rejection, before any check runs.

sqlalchemy.exc.OperationalError: (psycopg2.OperationalError)
FATAL:  password authentication failed for user "ci_user"

Common causes

Credentials not injected from secrets

The connection config interpolates env vars that were never set from repository or org secrets, so the tool sends empty or default credentials.

A rotated or scoped-out credential

The password, key pair, or OIDC role was rotated or lacks access to the warehouse, so authentication is rejected.

How to fix it

Inject credentials from CI secrets

1. Store warehouse credentials as CI secrets.
2. Expose them as env vars in the quality step.
3. Reference them in the tool config via interpolation.

env:
  DB_USER: ${{ secrets.WAREHOUSE_USER }}
  DB_PASSWORD: ${{ secrets.WAREHOUSE_PASSWORD }}

Use OIDC for keyless auth where supported

For Snowflake or BigQuery, authenticate the runner via OIDC so no long-lived password sits in CI, and grant the federated identity read access.

permissions:
  id-token: write   # let the runner request an OIDC token
  contents: read

How to prevent it

• Keep warehouse credentials in CI secrets, never in config.
• Prefer OIDC/keyless auth over long-lived passwords.
• Grant least-privilege read access to the quality role.

Frequently asked questions

Related guides

References

• GitHub Actions documentation