Snowflake Git Integration: Version-Control SQL Scripts and Notebooks

Snowflake Git Integration registers a Git repository (GitHub, GitLab, etc.) as a Snowflake database object, letting you directly reference and execute the SQL scripts, Python files, and configuration files it contains from inside Snowflake. It's a great fit for Infrastructure as Code (IaC) and CI/CD pipeline integration, and you can also use it to version-control Snowflake Notebooks.

Git Integration Setup Flow

Step 1: create the Secret (credentials)
  ↓
Step 2: create the API Integration (connection to the Git API)
  ↓
Step 3: create the Git Repository object
  ↓
Step 4: sync with the remote using FETCH
  ↓
Step 5: reference files and run scripts

Step 1: Create the authentication Secret

-- Store a GitHub Personal Access Token (PAT)
CREATE OR REPLACE SECRET git_pat_secret
  TYPE = PASSWORD
  USERNAME = 'github-username'
  PASSWORD = 'ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx';

-- A Secret is not needed for public repositories

Step 2: Create the API Integration

-- API Integration for GitHub
CREATE OR REPLACE API INTEGRATION github_api_integration
  API_PROVIDER = git_https_api
  API_ALLOWED_PREFIXES = ('https://github.com/my-org/')
  ALLOWED_AUTHENTICATION_SECRETS = (git_pat_secret)
  ENABLED = TRUE;

Step 3: Create the Git Repository

-- Create the Git Repository object
CREATE OR REPLACE GIT REPOSITORY analytics_db.public.my_sql_repo
  API_INTEGRATION = github_api_integration
  GIT_CREDENTIALS = git_pat_secret
  ORIGIN = 'https://github.com/my-org/snowflake-sql-scripts.git';

-- For a public repository (no authentication)
CREATE OR REPLACE GIT REPOSITORY analytics_db.public.public_repo
  API_INTEGRATION = github_api_integration
  ORIGIN = 'https://github.com/my-org/public-scripts.git';

Step 4: Fetch from the remote repository

-- Pull the latest from the remote repository
ALTER GIT REPOSITORY analytics_db.public.my_sql_repo FETCH;

-- List the branches
SHOW GIT BRANCHES IN analytics_db.public.my_sql_repo;

-- List the tags
SHOW GIT TAGS IN analytics_db.public.my_sql_repo;

Browsing Files

-- List the files on the main branch
LIST @analytics_db.public.my_sql_repo/branches/main/;

-- List the files in a specific directory
LIST @analytics_db.public.my_sql_repo/branches/main/sql/transforms/;

-- List the files at a specific tag
LIST @analytics_db.public.my_sql_repo/tags/v1.2.0/;

-- Read a file's contents
SELECT $1 AS content
FROM @analytics_db.public.my_sql_repo/branches/main/README.md
(FILE_FORMAT => 'util_db.formats.text_raw');

Executing SQL Scripts

-- Run a SQL script from the Git Repository directly
EXECUTE IMMEDIATE FROM
  @analytics_db.public.my_sql_repo/branches/main/sql/create_tables.sql;

-- Run the script from a specific tag (version)
EXECUTE IMMEDIATE FROM
  @analytics_db.public.my_sql_repo/tags/v1.2.0/sql/migrations/001_add_columns.sql;

-- Run the script with variables
EXECUTE IMMEDIATE FROM
  @analytics_db.public.my_sql_repo/branches/main/sql/parameterized_query.sql
  USING (target_date => '2026-03-27', batch_size => 10000);

Git Repository Path Structure

Integration with Snowflake Notebooks

By linking a Snowsight Notebook to a Git repository, the Notebook's versions are managed through Git.

• Connect a Git repository to a Notebook from the Snowsight UI
• Switch branches, commit, and push directly from the UI
• Multiple data scientists can collaborate on the same Notebook through branches
• Run pull-request-based review workflows on GitHub or GitLab

CI/CD Pipeline Pattern

-- Automate FETCH -> run script with a Task
CREATE OR REPLACE TASK daily_deploy
  WAREHOUSE = ops_wh
  SCHEDULE = 'USING CRON 0 6 * * * UTC'
AS
  BEGIN
    ALTER GIT REPOSITORY my_sql_repo FETCH;
    EXECUTE IMMEDIATE FROM
      @my_sql_repo/branches/main/sql/daily_etl.sql;
  END;

ALTER TASK daily_deploy RESUME;

Required Privileges

Best Practices

• Tag-based deployments: in production, reference tags rather than branches so you execute a known, pinned version of the script.
• Schedule periodic FETCH with a Task: run FETCH on a schedule via a Task so manual fetches don't get missed.
• Tighten API_ALLOWED_PREFIXES: narrow the API Integration's API_ALLOWED_PREFIXES to the smallest set of repositories you actually need.
• Rotate Secrets: set an expiration on Personal Access Tokens and rotate the Secret on a regular cadence.

Check Your Understanding

Frequently Asked Questions