Connect CoCo in Snowsight to GitHub¶

Introduction¶

You can connect your GitHub account to Cortex Code (CoCo) in Snowsight. After you connect, CoCo can clone your repositories, push branches, and open pull requests on your behalf, so that you can work on code in GitHub without leaving Snowsight.

CoCo connects to GitHub through the Snowflake CoCo GitHub App and OAuth. Each user authorizes CoCo with their own GitHub account, so CoCo can access only the repositories that the user’s GitHub account can access.

Setup has two parts:

• An administrator sets up the integration once. A GitHub organization administrator installs the Snowflake CoCo GitHub App, and a Snowflake account administrator creates a security integration for it. For instructions, see set up the GitHub integration.
• Each user connects their GitHub account. For instructions, see connect your GitHub account.

Set up the GitHub integration¶

Before you begin¶

Make sure that you have the following:

• A Snowflake account that is enabled for this preview. To request access, contact your Snowflake account team.
• The ACCOUNTADMIN role in that Snowflake account.
• Administrator access to the GitHub organization or account that owns the repositories that you want CoCo to work with.

Install the Snowflake CoCo GitHub App¶

A GitHub organization administrator installs the Snowflake CoCo GitHub App on the GitHub organization or account. During the installation, choose which repositories the app can access.

Create the security integration¶

Using the ACCOUNTADMIN role, create a security integration for GitHub, grant USAGE on it to the roles whose users need GitHub access, and then enable it:

1. Create the security integration. Setting ENABLED = FALSE creates it in a disabled state, so that no one can use it until you finish granting access:

   Copy code

   USE ROLE ACCOUNTADMIN;
   
   CREATE SECURITY INTEGRATION cortex_code_github_integration
     TYPE = EXTERNAL_APPLICATION
     APPLICATION_NAME = 'SNOWFLAKE$CORTEX_GITHUB'
     API_READ_ALLOWED_PREFIXES = ('https://github.com/')
     API_WRITE_ALLOWED_PREFIXES = ('https://github.com/')
     ENABLED = FALSE;
   

   API_READ_ALLOWED_PREFIXES and API_WRITE_ALLOWED_PREFIXES set the URL prefixes that CoCo can read from and write to. The https://github.com/ prefix covers all of github.com. The GitHub App installation still limits which repositories CoCo can write to.

2. Grant the USAGE privilege on the integration to each role whose users need to connect to GitHub. To give every user in the account access, grant it to the PUBLIC role:

   Copy code

   GRANT USAGE ON INTEGRATION cortex_code_github_integration TO ROLE PUBLIC;
   

3. Enable the integration:

   Copy code

   ALTER SECURITY INTEGRATION cortex_code_github_integration SET ENABLED = TRUE;
   

4. Verify the integration’s properties and grants:

   Copy code

   DESCRIBE SECURITY INTEGRATION cortex_code_github_integration;
   
   SHOW GRANTS ON INTEGRATION cortex_code_github_integration;
   

Connect your GitHub account¶

Before you start, make sure that an administrator has set up the GitHub integration and that your role has the USAGE privilege on it.

To connect your GitHub account, do the following:

1. Sign in to Snowsight and open CoCo.

2. In the message box, select the project menu, and then select Git settings.

   Agent settings opens on the Integrations tab. You can also open it by selecting Settings » Account » Agent settings » Integrations.

3. On the GitHub tile, select Connect. GitHub opens an authorization window for Snowflake CoCo.

4. In the authorization window, select Authorize.

After you authorize, the window closes, and CoCo can access your GitHub repositories.

Connect your GitHub account by using SQL¶

If you can’t use Snowsight, for example when you connect a service user or work from the command line, you can complete the OAuth flow with SQL instead:

1. Start the OAuth flow, specifying the name of the security integration that your administrator created:

   Copy code

   SELECT SYSTEM$START_USER_OAUTH_FLOW('cortex_code_github_integration');
   

   The function returns a GitHub authorization URL.

2. Open the URL in a browser, and then select Authorize.

   GitHub redirects your browser to a Snowflake callback URL. Copy the query string from the redirected URL, which is everything after the ? character. It has the form code=<code>&iss=<issuer>&state=<state>.

3. In the same session that you used in step 1, finish the OAuth flow by passing the query string:

   Copy code

   SELECT SYSTEM$FINISH_OAUTH_FLOW('code=<code>&iss=<issuer>&state=<state>');
   

Use Snowflake CLI¶

When you run these functions with the snow sql command, start an interactive session so that both functions run in the same session. Also disable SQL templating, because Snowflake CLI otherwise interprets each &<name> in the query string as a template variable and fails with an error such as SQL template rendering error: 'iss' is undefined:

snow sql --enable-templating NONE

Work with a repository¶

To work on a repository, select the project menu in the CoCo message box, and then either select a repository from the list or paste its name in owner/repo format. Then describe the task in the message box. For example:

Fix the failing unit test in tests/test_orders.py, then open a pull request with the fix.

CoCo clones the repository into its sandbox and makes the changes. CoCo can then push a branch and open a pull request on your behalf.

Disconnect your GitHub account¶

To remove CoCo’s access to your GitHub account, open Settings » Account » Agent settings » Integrations, and then select Disconnect on the GitHub tile.

Limitations¶

During the preview, the GitHub integration has the following limitations:

• Write access depends on the GitHub App installation. CoCo can push branches and open pull requests only in repositories where the Snowflake CoCo GitHub App is installed. To give CoCo write access to more repositories, ask your GitHub organization administrator to add them to the app’s installation.
• Only GitHub is supported. The integration supports repositories on github.com. Other Git hosts aren’t supported.

Related documentation¶

• CoCo in Snowsight
• Cloud Agents
• Cortex Agents for Slack