[sfc-gh-cnantasenamat]

Summary

• Add a guide for a five-stage GitHub Actions pipeline that deploys and evaluates a semantic view and Cortex Agent before promoting the agent candidate.
• Keep the existing personal companion and notebook links. Submit only site/sfguides/src/semantic-view-eval-cicd/semantic-view-eval-cicd.md; no application code, notebooks, logs, or local reports.
• Clarify notebook downloads, best-effort alias assignment, demonstration thresholds, and the lack of isolated semantic-view/dashboard rollout. Add resource-scoped cleanup and correct formatting, job naming, setup output, and demo-data dates.

Historical live verification

Run 35487762396 completed successfully on September 20, 2026. All five jobs passed using OIDC: validate, deploy_candidate, eval_sv, eval, and promote.

The tested revision was 0bbca209ac473d32aeab59b7470ff9c884478e93. The current companion revision, d26456c32ad23ab04d0fe4b62d7c29fc1735c2f7, adds only LICENSE and CODEOWNERS; executable source is unchanged. Analyst SQL correctness was 0.375 against the 0.35 demonstration floor. Agent scores were 1.0 / 0.967 / 1.0 against 0.70 floors. Default-version promotion completed; optional production-alias assignment warned.

Validation and review

• Mechanical guide checks and whitespace checks pass.
• Seven external HTTPS destinations return 200; GitHub repository and notebook destinations verified.
• Exact one-file source/report/submission/ZIP identity verified; disclosure review completed.
• Notebook runtime, clean-account setup/cleanup, deliberate regression exercise, and git-workspace path remain outside the confirmed historical pipeline run.
• Review OIDC subject-format/token diagnostic instructions, first-deployment version semantics, and website rendering before release.

Generated with Snowflake CoCo

[snowflake-security-bot]

Snowflake Security Review

Security grade: A — Passed ✅

This PR was classified as LOW risk by the automated pre-screen.

[sfc-gh-amadan]

Blocking

• Clean Up (lines 332–340): the reader ran setup.sql as ACCOUNTADMIN and created everything, so "ask your administrator" doesn't fit. Replace steps 2–4 with the commands:

  DROP DATABASE IF EXISTS SV_EVAL_CICD;
  DROP USER IF EXISTS SV_EVAL_CICD_USER;
  DROP ROLE IF EXISTS SV_EVAL_CICD_ROLE;
  -- Only if COMPUTE_WH was created by setup.sql:
  -- DROP WAREHOUSE IF EXISTS COMPUTE_WH;

Suggested

• Overview: rename ### Prerequisites to ### What You'll Need.
• Configure CI Auth (lines 113–138): asking the reader to trigger a failing run just to read the subject claim is awkward. Lead with the documented formats (repo:<owner>/<repo>:ref:refs/heads/main for personal repos), and keep the error message as a fallback.

[sfc-gh-cnantasenamat]

Thanks @sfc-gh-amadan, addressed in 798efe2:

Blocking

• Clean Up now drops SV_EVAL_CICD, SV_EVAL_CICD_USER and SV_EVAL_CICD_ROLE as ACCOUNTADMIN. DROP WAREHOUSE COMPUTE_WH is included but commented out, since setup.sql uses CREATE WAREHOUSE IF NOT EXISTS. Step 1 is now a concrete instruction to disable the workflow (gh workflow disable deploy.yml), and step 3 deletes the SNOWFLAKE_ACCOUNT secret.

Suggested

• Renamed Prerequisites to What You'll Need.
• Configure CI Auth now leads with GitHub's documented default subject repo:<you>/<your-repo>:ref:refs/heads/main and uses it in the ALTER USER block. The ID-embedded org format, the error-message fallback and the token-decode command now sit in a note.