Snowflake CLI で Streamlit in Snowflake の GitHub Actions 経由でのデプロイを試してみた

my_sis_app/
├── .keys/                   # ローカルのみ（Git管理しない）
├── .streamlit/              # ローカルのみ（Git管理しない）
│   └── secrets.toml
├── output/                  # 生成物
│   └── bundle/
├── pyproject.toml
├── snowcli.toml             # ローカルのみ（Git管理しない）
├── snowflake.yml
├── streamlit_app.py
└── yasuhara_streamlit_app.egg-info/  # 生成物

touch .gitignore

# Secrets / keys 
.streamlit/secrets.toml
.keys/

# Local venv
.venv/

# Generated by Snowflake CLI / builds
output/
*.egg-info/

# Python cache
__pycache__/
*.pyc

# Snowflake CLI config 
snowcli.toml

mkdir -p config

cat > config/config.toml << 'EOF'
default_connection_name = "workflow"

[connections.workflow]
EOF

default_connection_name = "workflow"

[connections.workflow]

git init
git status

git add .gitignore config/ pyproject.toml snowflake.yml streamlit_app.py
git commit -m "Initial commit"

git remote add origin git@github.com:<ユーザー>/<リポジトリ名>.git

git push -u origin main

USE ROLE USERADMIN;

CREATE OR REPLACE USER yasuhara_git_user
    DEFAULT_ROLE = yasuhara_st_creator
    DEFAULT_SECONDARY_ROLES = ()
    TYPE = SERVICE;

GRANT ROLE yasuhara_st_creator TO USER yasuhara_git_user;

ALTER USER yasuhara_git_user SET RSA_PUBLIC_KEY = 'MII・・・';

USE ROLE ACCOUNTADMIN;

CREATE OR REPLACE NETWORK POLICY yasuhara_github_actions_network_policy
  ALLOWED_NETWORK_RULE_LIST = ('SNOWFLAKE.NETWORK_SECURITY.GITHUBACTIONS_GLOBAL');

-- ポリシーをユーザーレベルで適用
ALTER USER yasuhara_git_user SET NETWORK_POLICY = yasuhara_github_actions_network_policy;

mkdir -p .github/workflows
code .github/workflows/deploy_streamlit_app.yml

name: Deploy Streamlit App to Snowflake

on:
  push:
    branches:
      - main
  workflow_dispatch:

jobs:
  deploy-to-snowflake:
    runs-on: ubuntu-latest

    env:
      SNOWFLAKE_CONNECTIONS_WORKFLOW_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
      SNOWFLAKE_CONNECTIONS_WORKFLOW_USER: ${{ secrets.SNOWFLAKE_USER }}
      SNOWFLAKE_CONNECTIONS_WORKFLOW_PRIVATE_KEY_RAW: ${{ secrets.SNOWFLAKE_PRIVATEKEY }}
      SNOWFLAKE_CONNECTIONS_WORKFLOW_WAREHOUSE: "X_SMALL_WH"
      SNOWFLAKE_CONNECTIONS_WORKFLOW_ROLE: "yasuhara_st_creator"
      SNOWFLAKE_CONNECTIONS_WORKFLOW_AUTHENTICATOR: "SNOWFLAKE_JWT"

    steps:
      - name: Checkout repository
        uses: actions/checkout@v4

      - name: Install Snowflake CLI
        uses: Snowflake-Labs/snowflake-cli-action@v1.5
        with:
          cli-version: "latest"
          default-config-file-path: 'config/config.toml'

      - name: Deploy to Snowflake
        run: |
          snow streamlit deploy yasuhara_streamlit --replace

git add .github/workflows/deploy_streamlit_app.yml
git commit -m "Add workflow"
git push

git checkout -b feature/add-note

import streamlit as st
import pendulum

st.title("コンテナランタイムのローカルからの開発テスト")

+st.write("開発ブランチでのローカル検証用に1行追加しました。")

st.subheader("PyPI package test: pendulum")

st.write("Now (Tokyo):", pendulum.now("Asia/Tokyo").to_iso8601_string())

# Snowflake接続確認（ローカルでは .streamlit/secrets.toml の [connections.snowflake] を使う）
st.subheader("Snowflake session check")
conn = st.connection("snowflake")
session = conn.session()

row = session.sql("""
select
  current_account() as acct,
  current_user() as usr,
  current_role() as role,
  current_timestamp() as ts
""").collect()[0]

st.json(row.as_dict())

streamlit run streamlit_app.py

git add streamlit_app.py
git commit -m "Add a note to the app"
git push -u origin feature/add-note