ci(snowflake): add OIDC token minting for WIF

Author: ragesh-g

.github/workflows/_integration-tests.yml

@@ -407,6 +407,9 @@ jobs:
                 working-directory: "./dbt-snowflake"
         environment:
             name: "dbt-snowflake"
+        permissions:
+            id-token: write
+            contents: read
         env:
             SNOWFLAKE_TEST_ACCOUNT: ${{ secrets.SNOWFLAKE_TEST_ACCOUNT }}
             SNOWFLAKE_TEST_USER: ${{ vars.SNOWFLAKE_TEST_USER }}
@@ -425,6 +428,7 @@ jobs:
             SNOWFLAKE_TEST_PRIVATE_KEY: ${{ secrets.SNOWFLAKE_TEST_PRIVATE_KEY }}
             SNOWFLAKE_TEST_PRIVATE_KEY_PASSPHRASE: ${{ secrets.SNOWFLAKE_TEST_PRIVATE_KEY_PASSPHRASE }}
             SNOWFLAKE_TEST_TOKEN: ${{ secrets.SNOWFLAKE_TEST_TOKEN }}
+            SNOWFLAKE_TEST_WIF_USER: ${{ vars.SNOWFLAKE_TEST_WIF_USER }}
         steps:
             - name: "Checkout ${{ inputs.branch }}"
               uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # actions/checkout@v4
@@ -445,8 +449,19 @@ jobs:
             - name: "Install hatch"
               uses: pypa/hatch@257e27e51a6a5616ed08a39a408a21c35c9931bc # pypa/hatch@install
 
+            - name: "Mint Snowflake OIDC token"
+              id: oidc
+              uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b
+              with:
+                  script: |
+                      const token = await core.getIDToken('snowflakecomputing.com');
+                      core.setSecret(token);
+                      core.setOutput('id_token', token);
+
             - name: "Run integration tests"
               run: hatch run ${{ inputs.hatch-env }}:integration-tests
+              env:
+                  OIDC_TOKEN: ${{ steps.oidc.outputs.id_token }}
 
     integration-tests-spark:
         if: contains(fromJSON(inputs.packages), 'dbt-spark')