Merge branch 'main' into remove-defaults

.github/CODEOWNERS

@@ -7,6 +7,13 @@ src/snowflake/cli/api/utils/ @snowflakedb/snowcli @snowflakedb/nade
 **/test_data @snowflakedb/snowcli @snowflakedb/nade
 tests_e2e/conftest.py @snowflakedb/snowcli @snowflakedb/nade
 
+## Workspaces (shared ownership)
+src/snowflake/cli/_plugins/workspace/ @snowflakedb/snowcli @snowflakedb/nade
+src/snowflake/cli/api/entities/ @snowflakedb/snowcli @snowflakedb/nade
+src/snowflake/cli/api/project/schemas/entities/ @snowflakedb/snowcli @snowflakedb/nade
+tests/workspace/ @snowflakedb/snowcli @snowflakedb/nade
+tests_integration/workspaces/ @snowflakedb/snowcli @snowflakedb/nade
+
 # Native Apps Owners
 **/nativeapp/ @snowflakedb/nade
 **/native_app/ @snowflakedb/nade

.github/workflows/test_cli_action.yaml

@@ -23,18 +23,18 @@ jobs:
           SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY: ${{ secrets.SNOWFLAKE_PRIVATE_KEY }}
         run: |
           PARENT_DIR=$(dirname "${{ github.workspace }}")
-          PRIVATE_KEY_PATH=$PARENT_DIR/.ssh/key.p8
+          PRIVATE_KEY_FILE=$PARENT_DIR/.ssh/key.p8
           echo "PARENT_DIR=$PARENT_DIR" >> $GITHUB_ENV
-          echo "PRIVATE_KEY_PATH=$PRIVATE_KEY_PATH" >> $GITHUB_ENV
+          echo "PRIVATE_KEY_FILE=$PRIVATE_KEY_FILE" >> $GITHUB_ENV
 
           mkdir $PARENT_DIR/.ssh
-          echo "${SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY}" > $PRIVATE_KEY_PATH
-          sudo chmod 600 $PRIVATE_KEY_PATH
+          echo "${SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY}" > $PRIVATE_KEY_FILE
+          sudo chmod 600 $PRIVATE_KEY_FILE
       - name: Test connection
         env:
           TERM: unknown
           SNOWFLAKE_CONNECTIONS_INTEGRATION_AUTHENTICATOR: SNOWFLAKE_JWT
           SNOWFLAKE_CONNECTIONS_INTEGRATION_USER: ${{ secrets.SNOWFLAKE_USER }}
           SNOWFLAKE_CONNECTIONS_INTEGRATION_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
-          SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY_PATH: ${{ env.PRIVATE_KEY_PATH }}
+          SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY_FILE: ${{ env.PRIVATE_KEY_FILE }}
         run: snow connection test -c integration | grep Status

.github/workflows/test_fork.yaml

@@ -38,13 +38,13 @@ jobs:
           SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY: ${{ secrets.SNOWFLAKE_PRIVATE_KEY }}
         run: |
           PARENT_DIR=$(dirname "${{ github.workspace }}")
-          PRIVATE_KEY_PATH=$PARENT_DIR/.ssh/key.p8
+          PRIVATE_KEY_FILE=$PARENT_DIR/.ssh/key.p8
           echo "PARENT_DIR=$PARENT_DIR" >> $GITHUB_ENV
-          echo "PRIVATE_KEY_PATH=$PRIVATE_KEY_PATH" >> $GITHUB_ENV
+          echo "PRIVATE_KEY_FILE=$PRIVATE_KEY_FILE" >> $GITHUB_ENV
 
           mkdir $PARENT_DIR/.ssh
-          echo "${SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY}" > $PRIVATE_KEY_PATH
-          sudo chmod 600 $PRIVATE_KEY_PATH
+          echo "${SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY}" > $PRIVATE_KEY_FILE
+          sudo chmod 600 $PRIVATE_KEY_FILE
 
       - name: Set up key (Windows)
         if: inputs.runs-on == 'windows-latest'
@@ -54,7 +54,7 @@ jobs:
           $parentDir = Split-Path -Parent "${{ github.workspace }}"
           $privateKeyPath = $parentDir + "\\ssh\\key.p8"
           echo "PARENT_DIR=$parentDir" >> $env:GITHUB_ENV
-          echo "PRIVATE_KEY_PATH=$privateKeyPath" >> $env:GITHUB_ENV
+          echo "PRIVATE_KEY_FILE=$privateKeyPath" >> $env:GITHUB_ENV
 
           mkdir $parentDir\\ssh
           Set-Content -Path $privateKeyPath -Value $env:SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY
@@ -67,7 +67,7 @@ jobs:
           SNOWFLAKE_CONNECTIONS_INTEGRATION_USER: ${{ secrets.SNOWFLAKE_USER }}
           SNOWFLAKE_CONNECTIONS_INTEGRATION_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
           SNOWFLAKE_CONNECTIONS_INTEGRATION_DATABASE: ${{ secrets.SNOWFLAKE_DATABASE }}
-          SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY_PATH: ${{ env.PRIVATE_KEY_PATH }}
+          SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY_FILE: ${{ env.PRIVATE_KEY_FILE }}
         run: python -m hatch run ${{ inputs.hatch-run }}
 
       # Update check run called "integration-fork"

.github/workflows/test_trusted.yaml

@@ -38,13 +38,13 @@ jobs:
           SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY: ${{ secrets.SNOWFLAKE_PRIVATE_KEY }}
         run: |
           PARENT_DIR=$(dirname "${{ github.workspace }}")
-          PRIVATE_KEY_PATH=$PARENT_DIR/.ssh/key.p8
+          PRIVATE_KEY_FILE=$PARENT_DIR/.ssh/key.p8
           echo "PARENT_DIR=$PARENT_DIR" >> $GITHUB_ENV
-          echo "PRIVATE_KEY_PATH=$PRIVATE_KEY_PATH" >> $GITHUB_ENV
+          echo "PRIVATE_KEY_FILE=$PRIVATE_KEY_FILE" >> $GITHUB_ENV
 
           mkdir $PARENT_DIR/.ssh
-          echo "${SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY}" > $PRIVATE_KEY_PATH
-          sudo chmod 600 $PRIVATE_KEY_PATH
+          echo "${SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY}" > $PRIVATE_KEY_FILE
+          sudo chmod 600 $PRIVATE_KEY_FILE
 
       - name: Set up key (Windows)
         if: inputs.runs-on == 'windows-latest'
@@ -54,18 +54,19 @@ jobs:
           $parentDir = Split-Path -Parent "${{ github.workspace }}"
           $privateKeyPath = $parentDir + "\\ssh\\key.p8"
           echo "PARENT_DIR=$parentDir" >> $env:GITHUB_ENV
-          echo "PRIVATE_KEY_PATH=$privateKeyPath" >> $env:GITHUB_ENV
+          echo "PRIVATE_KEY_FILE=$privateKeyPath" >> $env:GITHUB_ENV
 
           mkdir $parentDir\\ssh
           Set-Content -Path $privateKeyPath -Value $env:SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY
         shell: pwsh
 
       - name: Run integration tests
         env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TERM: unknown
           SNOWFLAKE_CONNECTIONS_INTEGRATION_AUTHENTICATOR: SNOWFLAKE_JWT
           SNOWFLAKE_CONNECTIONS_INTEGRATION_USER: ${{ secrets.SNOWFLAKE_USER }}
           SNOWFLAKE_CONNECTIONS_INTEGRATION_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
           SNOWFLAKE_CONNECTIONS_INTEGRATION_DATABASE: ${{ secrets.SNOWFLAKE_DATABASE }}
-          SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY_PATH: ${{ env.PRIVATE_KEY_PATH }}
+          SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY_FILE: ${{ env.PRIVATE_KEY_FILE }}
         run: python -m hatch run ${{ inputs.hatch-run }}

CONTRIBUTING.md

@@ -82,7 +82,7 @@ where ``<key>`` is the name of the key. The following environment variables are
 - `SNOWFLAKE_CONNECTIONS_INTEGRATION_HOST`
 - `SNOWFLAKE_CONNECTIONS_INTEGRATION_ACCOUNT`
 - `SNOWFLAKE_CONNECTIONS_INTEGRATION_USER`
-- `SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY_PATH`
+- `SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY_FILE` (`SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY_PATH` will work too, but preferable is with `_FILE` ending)
 - `SNOWFLAKE_CONNECTIONS_INTEGRATION_ROLE`
 - `SNOWFLAKE_CONNECTIONS_INTEGRATION_DATABASE`
 - `SNOWFLAKE_CONNECTIONS_INTEGRATION_WAREHOUSE`

RELEASE-NOTES.md

@@ -18,11 +18,18 @@
 ## Backward incompatibility
 
 ## Deprecations
+* Renamed `private-key-path` flag to `private-key-file`, added `private-key-path` as an alias for backward compatibility.
 
 ## New additions
+* Added templates expansion of arbitrary files for Native Apps through `templates` processor.
 
 ## Fixes and improvements
-
+* Duplicated keys in `snowflake.yml` are now detected and reported.
+* Fixed git execute not working with upper case in directory name.
+* Fixed `snow git setup` command behaviour for fully qualified repository names.
+* Fixed `snow git setup` command behaviour in case API integration or secret with default name already exists.
+* `snow streamlit deploy` will check for existing streamlit instance before deploying anything.
+* Fixed `snow snowpark package create` creating empty zip when package name contained capital letters.
 
 # v3.0.0
 ## Backward incompatibility
@@ -57,7 +64,6 @@
 * Improved error message for incompatible parameters.
 * Fixed SQL error when running `snow app version create` and `snow app version drop` with a version name that isn't a valid Snowflake unquoted identifier
 
-
 # v2.8.0
 ## Backward incompatibility
 

pyproject.toml

@@ -27,21 +27,21 @@ readme = "README.md"
 dependencies = [
   "jinja2==3.1.4",
   "pluggy==1.5.0",
-  "PyYAML==6.0.1",
+  "PyYAML==6.0.2",
   "packaging",
-  "rich==13.7.1",
+  "rich==13.8.0",
   "requests==2.32.3",
-  "requirements-parser==0.10.2",
-  "setuptools==70.3.0",
+  "requirements-parser==0.11.0",
+  "setuptools==74.1.2",
   'snowflake.core==0.8.0; python_version < "3.12"',
-  "snowflake-connector-python[secure-local-storage]==3.12.0",
+  "snowflake-connector-python[secure-local-storage]==3.12.1",
   'snowflake-snowpark-python>=1.15.0;python_version < "3.12"',
   "tomlkit==0.13.2",
-  "typer==0.12.4",
+  "typer==0.12.5",
   "urllib3>=1.24.3,<2.3",
   "GitPython==3.1.43",
   "pip",
-  "pydantic==2.8.2",
+  "pydantic==2.9.1",
 ]
 classifiers = [
   "Development Status :: 5 - Production/Stable",
@@ -61,7 +61,7 @@ development = [
   "pre-commit>=3.5.0",
   "pytest==8.3.2",
   "pytest-randomly==3.15.0",
-  "syrupy==4.6.1",
+  "syrupy==4.7.1",
 ]
 
 [project.urls]
@@ -119,7 +119,7 @@ pre-install-commands = [
 features = ["development"]
 
 [tool.hatch.envs.integration.scripts]
-test = ["python scripts/run_tests_with_retry.py Integration -m integration -n6 --dist=worksteal"]
+test = ["pytest -m integration -n6 --dist=worksteal --deflake-test-type=integration"]
 
 [[tool.hatch.envs.local.matrix]]
 python = ["3.10", "3.11", "3.12"]

scripts/cleanup.py

@@ -55,8 +55,9 @@ def remove_resources(single: str, plural: str, known_instances: t.List[str], rol
         "authenticator": "SNOWFLAKE_JWT",
         "account": os.getenv("SNOWFLAKE_CONNECTIONS_INTEGRATION_ACCOUNT"),
         "user": os.getenv("SNOWFLAKE_CONNECTIONS_INTEGRATION_USER"),
-        "private_key_path": os.getenv(
-            "SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY_PATH"
+        "private_key_file": os.getenv(
+            "SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY_FILE",
+            os.getenv("SNOWFLAKE_CONNECTIONS_INTEGRATION_PRIVATE_KEY_PATH"),
         ),
         "database": "SNOWCLI_DB",
         "role": role,

snyk/requirements.txt

@@ -1,22 +1,22 @@
 jinja2==3.1.4
 pluggy==1.5.0
-PyYAML==6.0.1
+PyYAML==6.0.2
 packaging
-rich==13.7.1
+rich==13.8.0
 requests==2.32.3
-requirements-parser==0.10.2
-setuptools==70.3.0
+requirements-parser==0.11.0
+setuptools==74.1.2
 snowflake.core==0.8.0; python_version < "3.12"
-snowflake-connector-python[secure-local-storage]==3.12.0
+snowflake-connector-python[secure-local-storage]==3.12.1
 snowflake-snowpark-python>=1.15.0;python_version < "3.12"
 tomlkit==0.13.2
-typer==0.12.4
+typer==0.12.5
 urllib3>=1.24.3,<2.3
 GitPython==3.1.43
 pip
-pydantic==2.8.2
+pydantic==2.9.1
 coverage==7.6.1
 pre-commit>=3.5.0
 pytest==8.3.2
 pytest-randomly==3.15.0
-syrupy==4.6.1
+syrupy==4.7.1

src/snowflake/cli/_app/snow_connector.py

@@ -71,6 +71,7 @@ def connect_to_snowflake(
 
     if connection_name:
         connection_parameters = get_connection_dict(connection_name)
+        connection_parameters = get_connection_dict(connection_name)
     elif temporary_connection:
         connection_parameters = {}  # we will apply overrides in next step
     else:
@@ -164,18 +165,24 @@ def _raise_errors_related_to_session_token(
 
 
 def update_connection_details_with_private_key(connection_parameters: Dict):
-    if "private_key_path" in connection_parameters:
-        if connection_parameters.get("authenticator") == "SNOWFLAKE_JWT":
-            private_key = _load_pem_to_der(connection_parameters["private_key_path"])
-            connection_parameters["private_key"] = private_key
-            del connection_parameters["private_key_path"]
-        else:
-            raise ClickException(
-                "Private Key authentication requires authenticator set to SNOWFLAKE_JWT"
-            )
+    if "private_key_file" in connection_parameters:
+        _load_private_key(connection_parameters, "private_key_file")
+    elif "private_key_path" in connection_parameters:
+        _load_private_key(connection_parameters, "private_key_path")
     return connection_parameters
 
 
+def _load_private_key(connection_parameters: Dict, private_key_var_name: str) -> None:
+    if connection_parameters.get("authenticator") == "SNOWFLAKE_JWT":
+        private_key = _load_pem_to_der(connection_parameters[private_key_var_name])
+        connection_parameters["private_key"] = private_key
+        del connection_parameters[private_key_var_name]
+    else:
+        raise ClickException(
+            "Private Key authentication requires authenticator set to SNOWFLAKE_JWT"
+        )
+
+
 def _update_connection_application_name(connection_parameters: Dict):
     """Update version and name of app handling connection."""
     connection_application_params = {
@@ -184,13 +191,13 @@ def _update_connection_application_name(connection_parameters: Dict):
     connection_parameters.update(connection_application_params)
 
 
-def _load_pem_to_der(private_key_path: str) -> bytes:
+def _load_pem_to_der(private_key_file: str) -> bytes:
     """
     Given a private key file path (in PEM format), decode key data into DER
     format
     """
 
-    with SecurePath(private_key_path).open(
+    with SecurePath(private_key_file).open(
         "rb", read_file_limit_mb=DEFAULT_SIZE_LIMIT_MB
     ) as f:
         private_key_pem = f.read()

src/snowflake/cli/_plugins/connection/commands.py

@@ -224,9 +224,10 @@ def add(
         prompt="Authentication method",
         help="Chosen authenticator, if other than password-based",
     ),
-    private_key_path: str = typer.Option(
+    private_key_file: str = typer.Option(
         EmptyInput(),
         "--private-key",
+        "--private-key-path",
         "-k",
         click_type=OptionalPrompt(),
         prompt="Path to private key file",
@@ -268,7 +269,7 @@ def add(
             warehouse=warehouse,
             role=role,
             authenticator=authenticator,
-            private_key_path=private_key_path,
+            private_key_file=private_key_file,
             token_file_path=token_file_path,
         ),
     )