GitHub Action that installs and configures the Snowflake CLI in a workflow, so you can deploy dbt, Streamlit, and DCM projects, ship Snowflake App Runtime apps, run SQL, and automate any Snowflake CLI task from CI/CD.

The action installs the Snowflake CLI in your workflow and can configure authentication, so later steps can run snow commands against Snowflake.

1. Installs uv.
2. Installs the Snowflake CLI with uv tool install --python 3.11 into an isolated tool environment. The snow command is available in later steps.
3. Copies your config.toml to ~/.snowflake/ if present (skipped if the file doesn't exist).
4. With use-oidc: true, reads a GitHub OIDC token and sets the workload-identity environment variables the CLI expects.

Install the Snowflake CLI and run commands against Snowflake from GitHub Actions:

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7

      - uses: snowflakedb/snowflake-actions@v3
        with:
          use-oidc: true

      - env:
          SNOWFLAKE_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
        run: snow connection test -x
      # snow dbt deploy, snow streamlit deploy, snow dcm deploy, snow sql -f migration.sql, etc.

• cli-version and custom-github-ref are mutually exclusive.
• use-oidc needs CLI 3.11+ and id-token: write.
• custom-github-ref installs from snowflake-cli instead of PyPI, and requires action v2+.
• default-config-file-path is skipped if the file is absent.

Use OIDC. It stores no secrets and is the only method we recommend. Key-pair and password auth exist only as fallbacks for environments where OIDC isn't available.

GitHub issues a short-lived OIDC token that Snowflake validates directly, so no private keys are stored as secrets. Requires CLI 3.11+.

1. Create a service user in Snowflake whose workload identity trusts your repo's GitHub OIDC tokens:

CREATE USER <username>
  TYPE = SERVICE
  WORKLOAD_IDENTITY = (
    TYPE = OIDC
    ISSUER = 'https://token.actions.githubusercontent.com'
    SUBJECT = '<your_subject>'
  );

SUBJECT must match the claim GitHub emits for the workflow. Use one of these formats:

See GitHub's OIDC subject claims for the full list.

2. Add the workflow. id-token: write is required to mint the token.

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: snowflakedb/snowflake-actions@v3
        with:
          use-oidc: true
      - env:
          SNOWFLAKE_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
        run: snow connection test -x

Use this only when OIDC isn't available. You can either:

• Pass credentials as environment variables and use -x so the CLI reads them without a config.toml.
• Define a connection in config.toml.

# Option 1: env vars + temporary connection
- uses: snowflakedb/snowflake-actions@v3
- env:
    SNOWFLAKE_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
    # ...other SNOWFLAKE_* vars — see docs above
  run: snow connection test -x

# Option 2: config.toml
- uses: snowflakedb/snowflake-actions@v3
  with:
    default-config-file-path: ./config.toml
- run: snow connection test

- uses: snowflakedb/snowflake-actions@<sha>   # commit SHA (most secure)
- uses: snowflakedb/snowflake-actions@v3.0.0  # exact patch
- uses: snowflakedb/snowflake-actions@v3      # floating major

Install the CLI from source (for example, to test an unreleased fix). v2+.

- uses: snowflakedb/snowflake-actions@v3
  with:
    custom-github-ref: "feature/my-branch"   # branch, tag, or commit

Runs on Linux, macOS, and Windows GitHub-hosted runners.

• Prefer OIDC over long-lived secrets, and pin the action to a commit SHA.
• Least-privilege permissions: OIDC needs id-token: write; most jobs need only contents: read.
• Set persist-credentials: false on actions/checkout.
• Never commit credentials. Inject them via GitHub Secrets at runtime.

A companion action that installs and configures the Cortex Code CLI (cortex) for CI/CD workflows. Requires snowflakedb/snowflake-actions@v3 to run first (provides snow CLI and OIDC auth).

- uses: snowflakedb/snowflake-actions@v3
  with:
    use-oidc: true

- uses: snowflakedb/snowflake-actions/cortex-code@v3

1. Verifies snow CLI is on PATH (fails fast if parent action wasn't used).
2. Installs CoCo CLI from the specified channel.
3. Pins a specific version if cli-version is set.
4. Auto-detects SNOWFLAKE_TOKEN in the environment (set by parent action's OIDC flow) and writes connections.toml so cortex -c <name> works. If a connection with that name already exists, it skips (no overwrite).

permissions:
  id-token: write
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    env:
      SNOWFLAKE_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
      SNOWFLAKE_USER: ${{ secrets.SNOWFLAKE_USER }}
      SNOWFLAKE_ROLE: ${{ secrets.SNOWFLAKE_ROLE }}
      SNOWFLAKE_WAREHOUSE: ${{ secrets.SNOWFLAKE_WAREHOUSE }}
    steps:
      - uses: actions/checkout@v7

      - uses: snowflakedb/snowflake-actions@v3
        with:
          use-oidc: true

      - uses: snowflakedb/snowflake-actions/cortex-code@v3
        with:
          cli-channel: beta

      - run: cortex exec --file .cortex/prompts/scan.md -c default --bypass --no-history

Runs on Linux (ubuntu) GitHub-hosted runners. Requires Python 3.11+ on PATH (satisfied by all GitHub-hosted runners).

On self-hosted runners that persist between jobs, add a cleanup step to remove credentials:

- name: Clean up credentials
  if: always()
  run: rm -f ~/.snowflake/connections.toml

Public Preview — Features and interfaces may change before general availability.

Four composite actions for automating Snowflake DCM Projects CI/CD pipelines. Each action handles one step of the lifecycle; compose them to build end-to-end workflows.

permissions:
  id-token: write
  contents: read
  pull-requests: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: DCM_STAGE
    env:
      SNOWFLAKE_USER: ${{ vars.SNOWFLAKE_USER }}
    steps:
      - uses: actions/checkout@v7

      - uses: snowflakedb/snowflake-actions/dcm/connection-test@v3
        with:
          target: DCM_STAGE
          project-path: my-dcm-project/
          snowflake-user: ${{ env.SNOWFLAKE_USER }}

      - uses: snowflakedb/snowflake-actions/dcm/plan@v3
        with:
          target: DCM_STAGE
          project-path: my-dcm-project/
          snowflake-user: ${{ env.SNOWFLAKE_USER }}
          comment-on-pr: "true"

      - uses: snowflakedb/snowflake-actions/dcm/deploy@v3
        with:
          target: DCM_STAGE
          project-path: my-dcm-project/
          snowflake-user: ${{ env.SNOWFLAKE_USER }}
          comment-on-pr: "true"

See the DCM actions README for full input/output references, authentication setup, and a complete multi-environment pipeline example.

Report issues or request features via GitHub Issues.