Skip to content

Update SQL view to use new data source - #230

Open
julianostefano wants to merge 23 commits into
Snowflake-Labs:mainfrom
julianostefano:main
Open

julianostefano wants to merge 23 commits into
Snowflake-Labs:mainfrom
julianostefano:main

Conversation

@julianostefano

Copy link
Copy Markdown

This pull request updates the data source references in the weather data pipeline to ensure consistency and correctness. The main change is switching the schema used for weather source tables in the views.sql file.

Data source updates:

  • Changed the schema in the FROM and JOIN clauses from WEATHER_SOURCE_LLC_FROSTBYTE to FROSTBYTE_WEATHERSOURCE for the history_day and postal_codes tables in views.sql.

Copilot AI lite review requested due to automatic review settings August 28, 2026 17:19

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@snowflake-security-bot snowflake-security-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Snowflake Security Review

Security grade: A — Passed

This PR was classified as LOW risk by the automated pre-screen.

@snowflake-security-bot snowflake-security-bot Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Snowflake Security Review

Security grade: A — Passed

This PR was classified as LOW risk by the automated pre-screen.

Comment on lines +20 to +24
env:
# Read connection secret
SNOWFLAKE_CONNECTIONS_ADVANCED_DATA_ENGINEERING_SNOWFLAKE_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
SNOWFLAKE_CONNECTIONS_ADVANCED_DATA_ENGINEERING_SNOWFLAKE_USER: ${{ secrets.SNOWFLAKE_USER }}
SNOWFLAKE_CONNECTIONS_ADVANCED_DATA_ENGINEERING_SNOWFLAKE_PASSWORD: ${{ secrets.SNOWFLAKE_PASSWORD }}

@arcticowl-ai-review-labs arcticowl-ai-review-labs Bot Aug 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚨 Critical blocker

🔴 HIGH · Deploy workflow runs on merged PRs from forks/branches and executes repo-controlled SQL with production Snowflake secret · CWE-829

How to override this blocker

Resolve the finding and push, or override it:

  1. On this comment: add a 👎 reaction and post an inline reply disputing it.
  2. Add the critical_blocker_force_override label to the PR to trigger re-evaluation.

Every Critical blocker on the PR must be disputed this way — the label on its own does not override a blocker that has no 👎 and reply.

✅ Resolved — no longer active on the latest commit.

Comment on lines +3 to +17
on:
pull_request:
types: [closed]
branches:
- staging
- main
push:
branches:
- staging
- main

jobs:
deploy_data_environment:
# Only run when PR is merged or on direct push to environment branches
if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.merged == true)

@arcticowl-ai-review-labs arcticowl-ai-review-labs Bot Aug 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚨 Critical blocker

🔴 HIGH · GitHub Actions workflow runs on pull_request:closed with merge gate but exposes Snowflake prod credentials to fork/branc · CWE-94

How to override this blocker

Resolve the finding and push, or override it:

  1. On this comment: add a 👎 reaction and post an inline reply disputing it.
  2. Add the critical_blocker_force_override label to the PR to trigger re-evaluation.

Every Critical blocker on the PR must be disputed this way — the label on its own does not override a blocker that has no 👎 and reply.

✅ Resolved — no longer active on the latest commit.

Comment on lines +20 to +24
env:
# Read connection secret
SNOWFLAKE_CONNECTIONS_ADVANCED_DATA_ENGINEERING_SNOWFLAKE_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
SNOWFLAKE_CONNECTIONS_ADVANCED_DATA_ENGINEERING_SNOWFLAKE_USER: ${{ secrets.SNOWFLAKE_USER }}
SNOWFLAKE_CONNECTIONS_ADVANCED_DATA_ENGINEERING_SNOWFLAKE_PASSWORD: ${{ secrets.SNOWFLAKE_PASSWORD }}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 MEDIUM · GitHub Actions workflow uses long-lived Snowflake password credential (ACCOUNTADMIN) with no rotation/least-privilege [N · CWE-798

- name: Deploy templates to data environment
run: |
# Export TARGET_BRANCH for use in this step
echo "Using branch: ${GITHUB_REF_NAME}"

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚨 Critical blocker

🔴 HIGH · Untrusted GITHUB_REF_NAME interpolated into snow git execute shell command enables command injection [NEW] · CWE-78

How to override this blocker

Resolve the finding and push, or override it:

  1. On this comment: add a 👎 reaction and post an inline reply disputing it.
  2. Add the critical_blocker_force_override label to the PR to trigger re-evaluation.

Every Critical blocker on the PR must be disputed this way — the label on its own does not override a blocker that has no 👎 and reply.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants