Snowflake Cortex Agents向けのAgent SkillをGitHubから連携してエージェントから使う

skills
└── exec-brief
    └── SKILL.md

name: Deploy Cortex Agent skills

on:
  push:
    branches:
      - main
    paths:
      - "skills/**"
      - ".github/workflows/snowflake-deploy.yml"

permissions:
  contents: read
  id-token: write

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: dev
    env:
      SNOWFLAKE_ACCOUNT: 'デプロイ先のアカウント識別子'
      SNOWFLAKE_DATABASE: ステージのあるデータベース名
      SNOWFLAKE_SCHEMA: ステージのあるスキーマ名
      SNOWFLAKE_STAGE: Skillsを配置するステージ名

    steps:
      - uses: actions/checkout@v4

      - uses: snowflakedb/snowflake-actions@v3
        with:
          use-oidc: true

      - name: Upload skills to stage
        shell: bash
        run: |
          set -euo pipefail

          stage="${SNOWFLAKE_DATABASE}.${SNOWFLAKE_SCHEMA}.${SNOWFLAKE_STAGE}"

          uploaded=0
          for dir in skills/*; do
            [ -d "$dir" ] || continue

            skill_name="$(basename "$dir")"
            skill_file="$dir/SKILL.md"

            [[ "$skill_name" =~ ^[A-Za-z0-9][A-Za-z0-9_-]*$ ]] || {
              echo "Invalid skill folder name: $skill_name"
              exit 1
            }

            [ -f "$skill_file" ] || {
              echo "Missing SKILL.md: $skill_file"
              exit 1
            }

            echo "Uploading: $skill_name"

            snow stage copy \
              "$skill_file" \
              "@${stage}/skills/${skill_name}/" \
              --overwrite \
              --no-auto-compress \
              --refresh \
              -x

            uploaded=$((uploaded + 1))
          done

          if [ "$uploaded" -eq 0 ]; then
            echo "No skills found under skills/"
            exit 1
          fi

          listed="$(
            snow sql \
              -q "LS @${stage}/skills/ PATTERN = '.*SKILL\\\\.md';" \
              --format json \
              --silent \
              -x
          )"

          listed_count="$(
            printf '%s\n' "$listed" |
            jq 'if type == "array" then length else 0 end'
          )"

          echo "Uploaded ${uploaded} skill(s); stage lists ${listed_count} SKILL.md file(s)"
          printf '%s\n' "$listed"

          if [ "$listed_count" -lt "$uploaded" ]; then
            echo "Stage listing is missing uploaded SKILL.md files"
            exit 1
          fi

-- デプロイ向けのロール作成
CREATE ROLE IF NOT EXISTS github_actions_skills_deploy_role;

-- ロールへの権限付与
GRANT USAGE ON DATABASE データベース名 TO ROLE github_actions_skills_deploy_role;
GRANT USAGE ON SCHEMA データベース名.スキーマ名 TO ROLE github_actions_skills_deploy_role;
GRANT USAGE ON WAREHOUSE COMPUTE_WH TO ROLE github_actions_skills_deploy_role;

GRANT READ
ON STAGE データベース名.スキーマ名.SKILL_STAGE
TO ROLE github_actions_skills_deploy_role;

GRANT WRITE
ON STAGE データベース名.スキーマ名.SKILL_STAGE
TO ROLE github_actions_skills_deploy_role;

CREATE USER github_actions_skills_deployer
  TYPE = SERVICE
  DEFAULT_ROLE = github_actions_skills_deploy_role
  DEFAULT_NAMESPACE = データベース名.スキーマ名
  DEFAULT_WAREHOUSE = COMPUTE_WH
  WORKLOAD_IDENTITY = (
    TYPE = OIDC
    ISSUER = 'https://token.actions.githubusercontent.com'
    SUBJECT = '`Default subject claim prefix値`:environment:dev'
  );

-- デプロイ向けユーザーへのロールの付与
GRANT ROLE github_actions_skills_deploy_role TO USER github_actions_skills_deployer;

snow git setup リポジトリ名

Origin url: Origin url: GitリポジトリのHTTPSリモートURL
Use secret for authentication? [y/N]: y
Secret identifier (will be created if not exists) [SUZUKI_SKILL_REPO_secret]: シークレット名
Secret 'シークレット名' will be created
username: GitHubユーザー名
password/token: 
API integration identifier (will be created if not exists) [SKILL_REPO_api_integration]: SKILL_REPO_api_integration 
Secret 'シークレット名' successfully created.
API integration 'SKILL_REPO_api_integration' successfully created.

+------------------------------------------------------------+
| status                                                     |
|------------------------------------------------------------|
| Git Repository リポジトリ名 was successfully created. |
+------------------------------------------------------------+