ci: split Snowflake integration tests from PR checks

.github/workflows/integration.yml

@@ -0,0 +1,54 @@
+name: integration
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
+  RUSTFLAGS: -Dwarnings
+
+jobs:
+  integration:
+    name: Snowflake integration
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+
+    env:
+      SNOWFLAKE_USERNAME: ${{ secrets.SNOWFLAKE_USERNAME }}
+      SNOWFLAKE_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
+      SNOWFLAKE_ROLE: ${{ secrets.SNOWFLAKE_ROLE }}
+      SNOWFLAKE_WAREHOUSE: ${{ secrets.SNOWFLAKE_WAREHOUSE }}
+      SNOWFLAKE_DATABASE: ${{ secrets.SNOWFLAKE_DATABASE }}
+      SNOWFLAKE_SCHEMA: ${{ secrets.SNOWFLAKE_SCHEMA }}
+      SNOWFLAKE_PRIVATE_KEY: ${{ secrets.SNOWFLAKE_PRIVATE_KEY }}
+      SNOWFLAKE_PRIVATE_KEY_PASSWORD: ${{ secrets.SNOWFLAKE_PRIVATE_KEY_PASSWORD }}
+
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - uses: dtolnay/rust-toolchain@f7ccc83f9ed1e5b9c81d8a67d7ad1a747e22a561 # 2025-12-17
+        with:
+          toolchain: stable
+
+      - name: Verify Snowflake credentials are configured
+        shell: bash
+        run: |
+          for name in \
+            SNOWFLAKE_USERNAME \
+            SNOWFLAKE_ACCOUNT \
+            SNOWFLAKE_PRIVATE_KEY \
+            SNOWFLAKE_PRIVATE_KEY_PASSWORD; do
+            if [[ -z "${!name}" ]]; then
+              echo "::error::Required integration secret $name is empty"
+              exit 1
+            fi
+          done
+
+      - name: Test integration
+        run: cargo test --profile ci --workspace --test integration

.github/workflows/test.yml

@@ -6,17 +6,12 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 env:
   CARGO_REGISTRIES_CRATES_IO_PROTOCOL: sparse
   RUSTFLAGS: -Dwarnings
-  SNOWFLAKE_USERNAME: ${{ secrets.SNOWFLAKE_USERNAME }}
-  SNOWFLAKE_ACCOUNT: ${{ secrets.SNOWFLAKE_ACCOUNT }}
-  SNOWFLAKE_ROLE: ${{ secrets.SNOWFLAKE_ROLE }}
-  SNOWFLAKE_WAREHOUSE: ${{ secrets.SNOWFLAKE_WAREHOUSE }}
-  SNOWFLAKE_DATABASE: ${{ secrets.SNOWFLAKE_DATABASE }}
-  SNOWFLAKE_SCHEMA: ${{ secrets.SNOWFLAKE_SCHEMA }}
-  SNOWFLAKE_PRIVATE_KEY: ${{ secrets.SNOWFLAKE_PRIVATE_KEY }}
-  SNOWFLAKE_PRIVATE_KEY_PASSWORD: ${{ secrets.SNOWFLAKE_PRIVATE_KEY_PASSWORD }}
 
 jobs:
   test:
@@ -60,8 +55,5 @@ jobs:
       - name: Test auto trait contracts
         run: cargo test --profile ci --workspace --all-features --test auto_trait_trybuild
 
-      - name: Test integration
-        run: cargo test --profile ci --workspace --test integration
-
       - name: Test documentation
         run: cargo test --profile ci --workspace --all-features --doc