GitHub installation

From the dbt project, frontier setup github writes .github/workflows/frontier.yml pinned to the installed runner version. The workflow installs the PyPI extra, not a Git SHA:

pip install "frontier-runner[snowflake]==0.1.1"

Important flags:

• --blocking sets FRONTIER_BLOCKING=true. The default is false so the first verification PR can upload a failed assessment without failing the GitHub check.
• --force overwrites an existing workflow. --yes accepts defaults.

The generated job compiles PR dbt artifacts, compiles the pull-request base into target-base/, fetches the active semantic manifest, then runs frontier inspect, frontier compare, and frontier prove. If dbt build or base compile fails, it writes frontier record-failure instead. FRONTIER_DRY_RUN must not be set in customer CI.

Secret values are never written into the workflow file.

• FRONTIER_API_URL (public HTTPS origin) and FRONTIER_API_KEY
• FRONTIER_ENTITY_HASH_KEY — generate with frontier setup hash-key. Rotating it changes entity fingerprints. It is not sent to SaaS.
• SNOWFLAKE_ACCOUNT, SNOWFLAKE_USER, SNOWFLAKE_PASSWORD

API secrets and Snowflake secrets stay in separate job environments.GITHUB_TOKEN is used only on the upload/PR-comment step and is never sent to Frontier SaaS. Workflow permissions need pull-requests: write.

After generating the file, commit it and open a test pull request. See SQL-change assessments.