Note: Snowflake CLI Github Actions is in Preview.
Snowflake CLI Github Actions streamline installing and using Snowflake CLI in your CI/CD workflows. The CLI is installed in
isolated way, making sure it won't conflict with dependencies of your project. It automatically sets up
the input configuration file within the ~/.snowflake/ directory.
The action enables automation of your Snowflake CLI tasks, such as deploying Native Apps or running Snowpark scripts within your Snowflake environment.
The specified Snowflake CLI version, for example 3.6.0. If not provided, the latest version of the Snowflake CLI is used.
The branch, tag, or commit to install from if you want to install the CLI directly from GitHub.
Note:
cli-versionandcustom-github-refcannot be used together. Please specify only one of these arguments at a time.
Path to the configuration file (config.toml) in your repository. The path must be relative to root of repository. The configuration file is not required when using a temporary connection (-x flag). Refer to the Snowflake CLI documentation for more details.
These steps are a prerequisite for both methods:
-
Generate a private key:
Generate a key pair for your snowflake account following this user guide.
-
Store credentials in GitHub secrets:
Store each credential, such as account, private key, and passphrase in GitHub Secrets. Refer to the GitHub Actions documentation for detailed instructions on how to create and manage secrets for your repository.
To set up Snowflake credentials for a temporary connection, follow these steps.
-
Map secrets to environment variables:
Map each secret to an environment variable using the format
SNOWFLAKE_<key>=<value>. For example:env: SNOWFLAKE_PRIVATE_KEY_RAW: ${{ secrets.SNOWFLAKE_PRIVATE_KEY_RAW }} SNOWFLAKE_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
-
Configure the Snowflake CLI Action: If you want to use the latest version, you don't need to include the
cli-versionparameter. Otherwise, include it along with a specific version.Example:
- uses: snowflakedb/snowflake-cli-action@v1.5 with: cli-version: "3.6.0"
-
[Optional] Set up a passphrase if private key is encrypted:
Add an environment variable named
PRIVATE_KEY_PASSPHRASEand set it to the private key passphrase. This passphrase is used by Snowflake to decrypt the private key.- name: Execute Snowflake CLI command env: PRIVATE_KEY_PASSPHRASE: ${{ secrets.PASSPHARSE }} run: | snow --version snow connection test -x
-
[Extra] Use a password instead of a private key:
Unset the environment variable
SNOWFLAKE_AUTHENTICATOR, and then add a new variable with the password as follows:env: SNOWFLAKE_USER: ${{ secrets.SNOWFLAKE_USER }} SNOWFLAKE_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }} SNOWFLAKE_PASSWORD: ${{ secrets.SNOWFLAKE_PASSWORD }}
Note: To enhance your experience when using a password and MFA, it is recommended to configure MFA caching. For more information, refer to the Snowflake CLI documentation.
For more information in setting Snowflake credentials using environment variables, refer to the Snowflake CLI documentation. And the instructions on defining environment variables within your Github CI/CD workflow can be found here.
To set up Snowflake credentials for a specific connection, follow these steps.
-
Add
config.tomlto your repository:Create a
config.tomlfile at the root of your repository with an empty connection configuration. For example:default_connection_name = "myconnection" [connections.myconnection]
This file serves as a template and should not contain actual credentials.
-
Map secrets to environment variables:
Map each secret to an environment variable using the format
SNOWFLAKE_CONNECTIONS_<connection-name>_<key>=<value>. This overrides the credentials defined inconfig.toml. For example:env: SNOWFLAKE_CONNECTIONS_MYCONNECTION_PRIVATE_KEY_RAW: ${{ secrets.SNOWFLAKE_PRIVATE_KEY_RAW }} SNOWFLAKE_CONNECTIONS_MYCONNECTION_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
-
Configure the Snowflake CLI action:
Add the
default-config-file-pathparameter to the Snowflake CLI action step in your workflow file. This specifies the path to yourconfig.tomlfile. For example:- uses: snowflakedb/snowflake-cli-action@v1 with: cli-version: "3.6.0" default-config-file-path: "config.toml"
Replace
latestwith a specific version of Snowflake CLI action, if needed. -
[Optional] Set up a passphrase if private key is encrypted:
Add an additional environment variable named
PRIVATE_KEY_PASSPHRASEand set it to the private key passphrase. This passphrase is used by Snowflake to decrypt the private key.- name: Execute Snowflake CLI command env: PRIVATE_KEY_PASSPHRASE: ${{ secrets.PASSPHARSE }} run: | snow --version snow connection test
-
[Extra] Use a password instead of private key:
Unset the environment variable
SNOWFLAKE_CONNECTIONS_MYCONNECTION_AUTHENTICATOR, and then add a new variable with the password as follows:env: SNOWFLAKE_CONNECTIONS_MYCONNECTION_USER: ${{ secrets.SNOWFLAKE_USER }} SNOWFLAKE_CONNECTIONS_MYCONNECTION_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }} SNOWFLAKE_CONNECTIONS_MYCONNECTION_PASSWORD: ${{ secrets.SNOWFLAKE_PASSWORD }}
Note: To enhance your experience when using a password and MFA, it is recommended to configure MFA caching. For more information, refer to the Snowflake CLI documentation.
Yaml file:
name: deploy
on: [push]
jobs:
version:
name: "Check Snowflake CLI version"
runs-on: ubuntu-latest
steps:
# Snowflake CLI installation
- uses: snowflakedb/snowflake-cli-action@v1.5
# Use the CLI
- name: Execute Snowflake CLI command
env:
SNOWFLAKE_AUTHENTICATOR: SNOWFLAKE_JWT
SNOWFLAKE_USER: ${{ secrets.SNOWFLAKE_USER }}
SNOWFLAKE_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
SNOWFLAKE_PRIVATE_KEY_RAW: ${{ secrets.SNOWFLAKE_PRIVATE_KEY_RAW }}
PRIVATE_KEY_PASSPHRASE: ${{ secrets.PASSPHARSE }} # Passphrase is only necessary if private key is encrypted.
run: |
snow --help
snow connection test -xConfiguration file:
default_connection_name = "myconnection"
[connections.myconnection]
Yaml file:
name: deploy
on: [push]
jobs:
version:
name: "Check Snowflake CLI version"
runs-on: ubuntu-latest
steps:
# Checkout step is necessary if you want to use a config file from your repo
- name: Checkout repo
uses: actions/checkout@v4
with:
persist-credentials: false
# Snowflake CLI installation
- uses: snowflakedb/snowflake-cli-action@v1.5
with:
default-config-file-path: "config.toml"
# Use the CLI
- name: Execute Snowflake CLI command
env:
SNOWFLAKE_CONNECTIONS_MYCONNECTION_AUTHENTICATOR: SNOWFLAKE_JWT
SNOWFLAKE_CONNECTIONS_MYCONNECTION_USER: ${{ secrets.SNOWFLAKE_USER }}
SNOWFLAKE_CONNECTIONS_MYCONNECTION_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
SNOWFLAKE_CONNECTIONS_MYCONNECTION_PRIVATE_KEY_RAW: ${{ secrets.SNOWFLAKE_PRIVATE_KEY_RAW }}
PRIVATE_KEY_PASSPHRASE: ${{ secrets.PASSPHARSE }} #Passphrase is only necessary if private key is encrypted.
run: |
snow --help
snow connection testTo install Snowflake CLI from a specific branch, tag, or commit in the GitHub repository (for example, to test unreleased features or a fork), use the following configuration: This feature is available from snowflake-cli-action v1.6
- uses: snowflakedb/snowflake-cli-action@v1.6
with:
custom-github-ref: "feature/my-branch" # or a tag/commit hashThis will install the CLI from the specified branch, tag, or commit. You can combine this with other inputs as needed.