fix(source-salesloft, source-aws-cloudtrail): bump stale SDM base image pin

[devin-ai-integration]

What

source-salesloft and source-aws-cloudtrail were the only two connectors left in the monorepo pinning connectorBuildOptions.baseImage to source-declarative-manifest:5.15.0 (365 connectors are on 7.24.0). That image has no airbyte user, while the shared docker-images/Dockerfile.manifest-only-connector ends with USER airbyte (added in #64938). Both connectors therefore build fine and then fail at container start:

docker: Error response from daemon: unable to find user airbyte: no matching entries in passwd file
... returned non-zero exit status 125

Already-published images are unaffected — they predate the USER airbyte change — but anything that builds from source is blocked: the pre-release publish workflow, the regression-test harness (fails at SPEC with Internal failure: true), and each connector's own CI image/spec check.

This unblocks #84300 and airbytehq/oncall#13289 (the Salesloft OAuth refresh fix), which cannot be published or regression-tested until a source build runs. #84300 also bumps Salesloft; whichever lands second needs to take the next patch version.

Resolves https://github.com/airbytehq/oncall/issues/13301:

• https://github.com/airbytehq/oncall/issues/13301

Community report: #84349

Requested by aaronsteers via the /ai-fix workflow.

How

Base image pin moved to the 7.24.0 pin used by the rest of the monorepo, plus a patch bump and changelog row per connector. manifest.yaml and components.py are untouched in both connectors.

Neither connector has enableProgressiveRollout/rolloutConfiguration, so plain semver with no -rc suffix. Neither has a pyproject.toml — for manifest-only connectors the base image pin is the CDK dependency, so this is a CDK 5 → 7 jump for both.

Review guide

1. airbyte-integrations/connectors/source-salesloft/metadata.yaml — base image 5.15.0 → 7.24.0, 1.5.2 → 1.5.3
2. airbyte-integrations/connectors/source-aws-cloudtrail/metadata.yaml — same base image change, 1.1.0 → 1.1.1 (the existing 1.0.0 breakingChanges entry is untouched)
3. docs/integrations/sources/salesloft.md, docs/integrations/sources/aws-cloudtrail.md — changelog rows

Breaking change evaluation

Assessed as not breaking, so a patch bump rather than a major. Evidence: both connectors were built locally against the 7.24.0 pin and discover was run with the real GSM acceptance-test configs. The catalogs came back unchanged — Salesloft: 30 streams, PK id, incremental cursor updated_at; CloudTrail: management_events, PK EventId, cursor EventTime. No spec change, no stream added or removed, no state-format change. All declarative component types in both manifests are recognized by CDK 7.24.0, and each manifest's declared version: (5.15.0 and 4.3.2) still loads. Both components.py modules import and construct cleanly inside the 7.24.0 image.

Test Coverage

No unit test is added. Neither connector has any test infrastructure (no unit_tests/, no pyproject.toml), and the change is a build/packaging pin with no connector logic to assert on — a unit test would run against the installed CDK, not against the base image the pin selects. Verification was done at the image level instead:

• Built each connector from docker-images/Dockerfile.manifest-only-connector with BASE_IMAGE set to the new pin; both images start and return a valid SPEC. The same build against the old 5.15.0 pin reproduces the exit-125 unable to find user airbyte failure.
• discover succeeds for both connectors on 7.24.0, with the dummy config and with the GSM config.
• check fails for both, but identically on 5.15.0 (run with an overridden container user so the old image can start at all) and on 7.24.0, so it is pre-existing and not caused by the bump: Salesloft returns HTTP 401 Invalid Bearer token and CloudTrail returns UnrecognizedClientException: The security token included in the request is invalid, i.e. the stored acceptance-test credentials are stale in both cases. For CloudTrail the signed request body, endpoint, target, content type, and SigV4 signed-header set were compared between the two CDK versions and match, so its custom SigV4 components.py is not affected by the CDK jump.

CI's connector image/spec checks are the real gate here, since they exercise the from-source build this PR fixes.

User Impact

None on sync behavior — streams, schemas, primary keys, cursors, spec, and state are unchanged. Users get connector images that can actually be built and published again, and the newer CDK underneath.

Can this PR be safely reverted and rolled back?

• YES 💚
• NO ❌

Link to Devin session: https://app.devin.ai/sessions/b5bc3fe4f6fb4b26b9a95adc0256bae5

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

👋 Greetings, Airbyte Team Member!

Here are some helpful tips and reminders for your convenience.

💡 Show Tips and Tricks

PR Slash Commands

Airbyte Maintainers (that's you!) can execute the following slash commands on your PR:

• 🛠️ Quick Fixes
  • /format-fix - Fixes most formatting issues.
  • /bump-version - Bumps connector versions, scraping changelog description from the PR title.
    • Bump types: patch (default), minor, major, major_rc, rc, promote.
    • The rc type is a smart default: applies minor_rc if stable, or bumps the RC number if already RC.
    • The promote type strips the RC suffix to finalize a release.
    • Example: /bump-version type=rc or /bump-version type=minor
  • /bump-progressive-rollout-version - Alias for /bump-version type=rc. Bumps with an RC suffix and enables progressive rollout.
• ❇️ AI Testing and Review (internal link: AI-SDLC Docs):
  • /ai-prove-fix - Runs prerelease readiness checks, including testing against customer connections.
  • /ai-canary-prerelease - Rolls out prerelease to 5-10 connections for canary testing.
  • /ai-review - AI-powered PR review for connector safety and quality gates.
• 📝 AI Documentation:
  • /ai-docs-review - AI-powered documentation review for PRs with connector changes.
  • /ai-create-docs-pr - Creates a documentation PR for connector changes, stacked on the current PR.
• 🚀 Connector Releases:
  • /publish-connectors-prerelease - Publishes pre-release connector builds (tagged as {version}-preview.{git-sha}) for all modified connectors in the PR.
  • /enable-autopilot-rollouts - Enables autopilot progressive rollouts for the modified connector(s) in the PR, remediating "autopilot rollouts not enabled for {connector-name}" auto-merge blockers. Sets defaultRolloutMode: autopilot and enableProgressiveRollout: true, preserving any existing autopilotConfig.
    • Optional args: connector=<CONNECTOR_NAME> (defaults to the modified connectors in the PR), strategy=fast|slow|default (defaults to fast).
    • Example: /enable-autopilot-rollouts or /enable-autopilot-rollouts connector=source-faker strategy=slow
• ☕️ JVM connectors:
  • /update-connector-cdk-version connector=<CONNECTOR_NAME> - Updates the specified connector to the latest CDK version.
    Example: /update-connector-cdk-version connector=destination-bigquery
• 🐍 Python connectors:
  • /poe connector source-example lock - Run the Poe lock task on the source-example connector, committing the results back to the branch.
  • /poe source example lock - Alias for /poe connector source-example lock.
  • /poe source example use-cdk-branch my/branch - Pin the source-example CDK reference to the branch name specified.
  • /poe source example use-cdk-latest - Update the source-example CDK dependency to the latest available version.
• ⚙️ Admin commands:
  • /force-merge reason="<REASON>" - Force merges the PR using admin privileges, bypassing CI checks. Requires a reason.
    Example: /force-merge reason="CI is flaky, tests pass locally"

📚 Show Repo Guidance

Helpful Resources

• Breaking Changes Guide - Breaking changes, migration guides, and upgrade deadlines
• Developing Connectors Locally
• Managing Connector Secrets
• On-Demand Regression Tests
• #connector-ci-issues
• #connector-publish-updates
• #connector-build-statuses

📝 Edit this welcome message.

[github-actions]

Note

Autopilot progressive rollouts are not enabled for the following modified connector(s):

• source-aws-cloudtrail
• source-salesloft

This is a courtesy heads-up only — it does not block merge or fail any check.
To enable automatic progressive rollouts for the connector(s) above, comment
/enable-autopilot-rollouts on this PR. This sets defaultRolloutMode: autopilot
and enableProgressiveRollout: true in each connector's metadata.yaml,
preserving any existing autopilotConfig.

[github-actions]

Deploy preview for airbyte-docs ready!

Project:	airbyte-docs
Status:	✅  Deploy successful!
Preview URL:	https://airbyte-docs-6ufsidkkt-airbyte-growth.vercel.app
Latest Commit:	b5547be

Deployed with vercel-action

[github-actions]

source-salesloft Connector Test Results

14 tests   9 ✅  1m 24s ⏱️
 1 suites  3 💤
 1 files    2 ❌

For more details on these failures, see this check.

Results for commit b5547be.

♻️ This comment has been updated with latest results.

[github-actions]

source-aws-cloudtrail Connector Test Results

14 tests   9 ✅  16m 32s ⏱️
 1 suites  3 💤
 1 files    2 ❌

For more details on these failures, see this check.

Results for commit b5547be.

[devin-ai-integration]

CI status: all mechanical checks pass (format, docs build, metadata/changelog validation, connector lint, static analysis, progressive rollout). The connector acceptance tests fail for both connectors, and as far as I can tell the failures are credential-related rather than caused by this bump — but I can't fix them from here, so flagging for a maintainer's call.

Show/Hide Evidence

source-salesloft (job 94450641065) — 2 failed, 9 passed, 3 skipped. Requests to the Salesloft API return HTTP 401 with an invalid-token message.

source-aws-cloudtrail (job 94450640991) — 2 failed, 9 passed, 3 skipped. test_docker_image_build_and_check and the basic read on management_events fail with:

AirbyteTracedException: Exhausted available request attempts.
Exception: HTTP Status Code: 400. Error: Bad request. Please check your request parameters.

Why this looks pre-existing rather than caused by the base image bump: running check locally against the old 5.15.0 pin (with an overridden container user, since that image can't otherwise start) produces the identical failures — Salesloft HTTP 401 Invalid Bearer token, CloudTrail UnrecognizedClientException: The security token included in the request is invalid. For CloudTrail the signed request body, endpoint, target, content type, and SigV4 signed-header set were also compared between CDK 5.15.0 and 7.24.0 and match, so the custom SigV4 component does not appear affected by the CDK jump.

That points at stale acceptance-test credentials in GSM for both connectors. SPEC and DISCOVER succeed on 7.24.0 for both, with unchanged catalogs; READ is unverified because of the credentials.

Refreshing the GSM acceptance-test secrets for both connectors would be needed to get these green. I have not touched manifest.yaml or components.py in either connector.