Skip to content

Enterprise Evaluation Guide

Status: Available in ETLantic 0.41.0. Deep diligence packet. Start with the one-page Evaluator Brief for residual risk and the capability matrix; use this page to assemble review links and artifacts.

PyPI classifiers ≠ enterprise readiness

Official engine packages declare Beta classifiers that match the ETLantic 0.40 Beta pilot envelope. Do not treat classifiers as an SLA, multi-tenant guarantee, or unrestricted enterprise production claim. See Capabilities and Production readiness.

How to use this packet

  1. Read Evaluator Brief (one page — residual lead + matrix).
  2. Run the green path below.
  3. Walk the checklist tables (security, ops, supply chain).
  4. Record accepted residual risks for your pilot topology.

Evaluation checklist

1. Understand the support boundary

Document Purpose
Capabilities Shipped vs experimental vs future
Production readiness Reference topology, required controls, honest gaps
Compare Positioning vs dbt, Airflow, Pandera, and peers
Support Community support scope and explicit non-goals
Performance envelope Local baselines; no capacity SLA

2. Run the green path

  1. Installation — pip install etlantic==0.41.0
  2. Quickstart — python -m etlantic init, validate, plan, run
  3. First Pipeline — evolve the generated project
  4. Engine selection — pick one engine tutorial

3. Security and trust review

Document Purpose
Security howto Day-2 allowlist / secrets / SARIF
Security Threat model, trust boundaries, verification checklist
Repository SECURITY.md Supported versions, private reporting, disclosure targets
Profiles hub Fail-closed production template and allowlist behavior
Secrets management Shipped secret providers and future cloud managers

Key facts for evaluators:

  • Plans and compiled artifacts are secret-free by design.
  • Production profiles require a non-empty plugin_allowlist and fail closed.
  • Plugin allowlists are selection, not sandboxing—use process isolation.
  • Release CI publishes a per-artifact SHA-256 manifest and GitHub build provenance attestations. CycloneDX SBOM generation is optional; verify whether the release contains the SBOM or sbom-warning.txt in Release artifact verification.

4. Operations and deployment review

Document Purpose
Deployment Process model, profile locking, adopter ownership
CI integration SARIF gates, production-profile validation pattern
Pilot walkthrough Controlled evaluation from install through production profile
Ops pilot Pin matrix, failure ownership, Airflow handoff
Ops examples Secrets, schema, SARIF snippets for CI

Copy prod.example.json into your own profiles/prod.json and fill assets for your pipeline bindings before production-profile testing.

5. Supply chain and versioning

Artifact Location
Version pins Pin etlantic==0.41.0 and matching plugin minors
Changelog CHANGELOG
Upgrade path Upgrade hub, Migration 0.38 → 0.39
API stability Deprecation policy, Surface inventory
Known limitations Known issues
SBOM / attestations Release CI digests + GitHub attestations — see Verify release attestations below

Verify release attestations

For a published GitHub Release asset (example: wheel from the v0.41.0 release):

# Download the wheel from the GitHub Release, then:
gh attestation verify path/to/etlantic-0.41.0-*.whl \
  --owner eddiethedean \
  --repo etlantic

After the v0.41.0 tag workflow succeeds, expect a per-artifact SHA-256 manifest (release-artifacts.json) and GitHub build provenance attestations. CycloneDX SBOM generation is optional: the release may include etlantic-environment.cdx.json or sbom-warning.txt—confirm the published asset before recording supply-chain evidence. Full checklist: Release artifact verification. Prefer exact pins (etlantic==0.41.0 and matching plugins) over floating ranges when recording diligence evidence.

Optional surfaces to review: etlantic-sqlmodel, etlantic-prefect (MVP), etlantic-datafusion (Experimental Alpha), and Medallantic (native medallion authoring in 0.29+; portable quality gates in 0.30+; execution/state semantics in 0.31+; PySpark/Delta differential parity in 0.32). Bronze/silver/gold vocabulary remains in Medallantic—not core.

6. Optional deep dives

Goal Guide
Gate A Polars↔Pandas interchange Interchange example
Portable transforms Portable transforms hub
Plugin SDK evaluation Building a Plugin
Resilience / performance Performance envelope, Production readiness
Programmatic authoring / JSON Programmatic authoring

Explicit non-goals (do not expect these from docs or product)

  • Multi-tenant isolation guarantees or a managed control plane in 0.39 (CP1 is incubated; production isolation remains 0.43); these are a planned first-class program, not a current GA capability
  • SOC2, GDPR, HIPAA, or other compliance attestations
  • HA/DR runbooks, Kubernetes reference architectures, or capacity SLAs in this Beta line; Kubernetes execution proof is planned for 0.47
  • Cloud secret managers (Vault, AWS Secrets Manager)—OS keyring ships via etlantic-keyring; optional cloud provider packs are planned for 0.51
  • Formal support SLAs or guaranteed response times

Decision summary

Adopt ETLantic when you need a typed control layer for single-tenant Python pipelines, secret-free plans, SARIF-friendly CI validation, and honest plugin boundaries—and you own deployment topology, compliance, and operational runbooks.

Defer or supplement when you require multi-tenant SaaS, enterprise compliance certifications, or a turnkey managed runtime without adopter-owned ops.

Next steps