deploy-streamlit-in-snowflake.yml

name: "Deploy Streamlit in Snowflake to the specified account"
on:
  workflow_dispatch: # Run only manually

jobs:
  deploy-streamlit-in-snowflake:
    runs-on: ubuntu-latest
    env:
      SNOWFLAKE_PRIVATE_KEY_PATH: /home/runner/work/key.p8

    steps:
      # Boilerplate
      - uses: actions/checkout@v3
      - uses: DeterminateSystems/nix-installer-action@main

      # Setup snowcli authentication from secrets
      - name: Setup private key from GH secrets
        shell: bash
        run: |
          mkdir -p ~/.snowflake
          echo "${{ secrets.SNOWFLAKE_PRIVATE_KEY }}" > ${{ env.SNOWFLAKE_PRIVATE_KEY_PATH }}

      - name: Setup snowcli from GH secrets
        shell: bash
        run: |
          mkdir -p ~/.snowflake
          cat <<EOF > ~/.snowflake/config.toml
          [connections.default]
          account = ${{ secrets.SNOWFLAKE_ACCOUNT }}
          user = ${{ secrets.SNOWFLAKE_USER }}
          authenticator = "SNOWFLAKE_JWT"
          private_key_path = "${{ env.SNOWFLAKE_PRIVATE_KEY_PATH }}"
          EOF

      # Actual deployment action
      - name: "Deploy Streamlit in Snowflake"
        # Effectively runs a wrapper around a tiny build script + snowcli to deploy the application
        # See $PRJ_ROOT/nix/apps/sis/default.nix for source
        run: nix run .#sis-deploy
        env:
          SIS_OWNER_ROLE: ${{ secrets.SIS_OWNER_ROLE }}
          SIS_APP_DATABASE: ${{ secrets.SIS_APP_DATABASE }}
          SIS_APP_SCHEMA: PUBLIC
          SIS_QUERY_WAREHOUSE: ${{ secrets.SIS_QUERY_WAREHOUSE }}
          SIS_GRANT_TO_ROLE: ${{ secrets.SIS_GRANT_TO_ROLE }}