Update SQL view to use new data source - #230
julianostefano wants to merge 23 commits into
Conversation
Fix missing data
Add GitHub Actions workflow for data environment deployment
| env: | ||
| # Read connection secret | ||
| SNOWFLAKE_CONNECTIONS_ADVANCED_DATA_ENGINEERING_SNOWFLAKE_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }} | ||
| SNOWFLAKE_CONNECTIONS_ADVANCED_DATA_ENGINEERING_SNOWFLAKE_USER: ${{ secrets.SNOWFLAKE_USER }} | ||
| SNOWFLAKE_CONNECTIONS_ADVANCED_DATA_ENGINEERING_SNOWFLAKE_PASSWORD: ${{ secrets.SNOWFLAKE_PASSWORD }} |
There was a problem hiding this comment.
🚨 Critical blocker
🔴 HIGH · Deploy workflow runs on merged PRs from forks/branches and executes repo-controlled SQL with production Snowflake secret · CWE-829
How to override this blocker
Resolve the finding and push, or override it:
- On this comment: add a 👎 reaction and post an inline reply disputing it.
- Add the
critical_blocker_force_overridelabel to the PR to trigger re-evaluation.
Every Critical blocker on the PR must be disputed this way — the label on its own does not override a blocker that has no 👎 and reply.
✅ Resolved — no longer active on the latest commit.
Fix syntax in GitHub Actions workflow for deployment
Fix missing data and CI
| on: | ||
| pull_request: | ||
| types: [closed] | ||
| branches: | ||
| - staging | ||
| - main | ||
| push: | ||
| branches: | ||
| - staging | ||
| - main | ||
|
|
||
| jobs: | ||
| deploy_data_environment: | ||
| # Only run when PR is merged or on direct push to environment branches | ||
| if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.merged == true) |
There was a problem hiding this comment.
🚨 Critical blocker
🔴 HIGH · GitHub Actions workflow runs on pull_request:closed with merge gate but exposes Snowflake prod credentials to fork/branc · CWE-94
How to override this blocker
Resolve the finding and push, or override it:
- On this comment: add a 👎 reaction and post an inline reply disputing it.
- Add the
critical_blocker_force_overridelabel to the PR to trigger re-evaluation.
Every Critical blocker on the PR must be disputed this way — the label on its own does not override a blocker that has no 👎 and reply.
✅ Resolved — no longer active on the latest commit.
Fix missing data 3
Fix missing data 4
Fix missing data 5
Fix missing data 6
Fix missing data 7
| env: | ||
| # Read connection secret | ||
| SNOWFLAKE_CONNECTIONS_ADVANCED_DATA_ENGINEERING_SNOWFLAKE_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }} | ||
| SNOWFLAKE_CONNECTIONS_ADVANCED_DATA_ENGINEERING_SNOWFLAKE_USER: ${{ secrets.SNOWFLAKE_USER }} | ||
| SNOWFLAKE_CONNECTIONS_ADVANCED_DATA_ENGINEERING_SNOWFLAKE_PASSWORD: ${{ secrets.SNOWFLAKE_PASSWORD }} |
There was a problem hiding this comment.
🟠 MEDIUM · GitHub Actions workflow uses long-lived Snowflake password credential (ACCOUNTADMIN) with no rotation/least-privilege [N · CWE-798
| - name: Deploy templates to data environment | ||
| run: | | ||
| # Export TARGET_BRANCH for use in this step | ||
| echo "Using branch: ${GITHUB_REF_NAME}" |
There was a problem hiding this comment.
🚨 Critical blocker
🔴 HIGH · Untrusted GITHUB_REF_NAME interpolated into snow git execute shell command enables command injection [NEW] · CWE-78
How to override this blocker
Resolve the finding and push, or override it:
- On this comment: add a 👎 reaction and post an inline reply disputing it.
- Add the
critical_blocker_force_overridelabel to the PR to trigger re-evaluation.
Every Critical blocker on the PR must be disputed this way — the label on its own does not override a blocker that has no 👎 and reply.
This pull request updates the data source references in the weather data pipeline to ensure consistency and correctness. The main change is switching the schema used for weather source tables in the
views.sqlfile.Data source updates:
FROMandJOINclauses fromWEATHER_SOURCE_LLC_FROSTBYTEtoFROSTBYTE_WEATHERSOURCEfor thehistory_dayandpostal_codestables inviews.sql.