gitlabds 2.3.1__tar.gz → 2.4.0__tar.gz

{gitlabds-2.3.1 → gitlabds-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitlabds
-Version: 2.3.1
+Version: 2.4.0
 Summary: GitLab Data Science Tools
 Author-email: Kevin Dietz <kdietz@gitlab.com>
 License-Expression: MIT
@@ -1135,7 +1135,7 @@ feature_drift = results['feature_drift']
 
 #### Snowflake Connectors
 
-Thin wrappers over the native Snowflake SDKs that resolve GitLab's two credential paths — local (dbt profile + SSO) and GitLab CI (env vars + password or key pair) — and then hand off to the native objects. Migrated from `gitlabdata.orchestration_utils`; see the migration notes at the end of this section.
+Thin wrappers over the native Snowflake SDKs that resolve GitLab's two credential paths — local (dbt profile + SSO) and GitLab CI (env vars + key-pair auth) — and then hand off to the native objects. Migrated from `gitlabdata.orchestration_utils`; see the migration notes at the end of this section.
 
 All of these require `pip install gitlabds[snowflake]`.
 
@@ -1144,7 +1144,7 @@ All of these require `pip install gitlabds[snowflake]`.
 #### Description
 Open a Snowflake connection, resolving credentials from your dbt profile locally or from GitLab CI environment variables in CI.
 
-`gitlabds.snowflake_engine_factory(args=None, role="DATA_SCIENCE_LOADER", run_target=None, profile_target="dev", schema="", auth_method="password", profiles_path=None, **connect_kwargs):`
+`gitlabds.snowflake_engine_factory(args=None, role="DATA_SCIENCE_LOADER", run_target=None, profile_target="dev", schema="", auth_method="keypair", profiles_path=None, **connect_kwargs):`
 
 #### Parameters:
 - **_args_** : Environment mapping to read CI credentials from. Defaults to `os.environ`. Ignored on the local path.
@@ -1152,10 +1152,12 @@ Open a Snowflake connection, resolving credentials from your dbt profile locally
 - **_run_target_** : `"local"` or `"ci"`. Inferred from the `GITLAB_CI` environment variable when not given.
 - **_profile_target_** : dbt profile output name. Only used on the local path.
 - **_schema_** : Schema to connect to. Falls back to the dbt profile's schema locally; when it resolves empty the connection is opened with no default schema.
-- **_auth_method_** : `"password"` or `"keypair"`. Only used on the CI path. Key pair secrets are not yet provisioned in CI.
+- **_auth_method_** : CI authentication method. `"keypair"` is the only supported value and the default, so passing it explicitly is the same as omitting it. Retained so callers that pass `auth_method="keypair"` keep working. `"password"` is accepted but ignored, with a logged warning naming the fix; any other value raises `ValueError`.
 - **_profiles_path_** : Override the dbt `profiles.yml` location (defaults to `~/.dbt/profiles.yml`). Only used on the local path.
 - **_\*\*connect_kwargs_** : Passed through to `snowflake.connector.connect()`, e.g. `autocommit=False`, `client_session_keep_alive=True`.
 
+> **CI authentication** uses key-pair auth exclusively (password-based CI auth was removed ahead of Snowflake's 2026-09-22 service-user password deprecation). In CI, reads `SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY` (raw PEM or base64-encoded PEM — base64 is required for GitLab CI/CD variables since multi-line values cannot be masked) and optionally `SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY_PASSPHRASE` (or the `_PASSWORD` variant) for encrypted keys.
+
 #### Returns
 - An open `snowflake.connector.SnowflakeConnection`. The caller owns its lifecycle.
 
@@ -1300,17 +1302,19 @@ gitlabds.snowflake_stage_load_copy_remove(
 #### Description
 Create a Snowflake Feature Store connection (Snowpark Session + native `FeatureStore`), resolving credentials the same way as `snowflake_engine_factory`.
 
-`gitlabds.feature_store_factory(args=None, role="DATA_SCIENCE_LOADER", run_target=None, profile_target="feature_store", auth_method="password", creation_mode="CreationMode.FAIL_IF_NOT_EXIST", profiles_path=None):`
+`gitlabds.feature_store_factory(args=None, role="DATA_SCIENCE_LOADER", run_target=None, profile_target="feature_store", auth_method="keypair", creation_mode="CreationMode.FAIL_IF_NOT_EXIST", profiles_path=None):`
 
 #### Parameters:
 - **_args_** : Environment mapping to read CI credentials from. Defaults to `os.environ`. Ignored on the local path.
 - **_role_** : Snowflake role for CI credentials. The feature store's database and schema come from `SNOWFLAKE_FEATURE_STORE_DATABASE` / `SNOWFLAKE_FEATURE_STORE_SCHEMA` on the CI path, not from the role's usual database/schema.
 - **_run_target_** : `"local"` or `"ci"`. Inferred from the `GITLAB_CI` environment variable when not given.
 - **_profile_target_** : dbt profile output name. Only used on the local path.
-- **_auth_method_** : `"password"` or `"keypair"`. Only used on the CI path.
+- **_auth_method_** : CI authentication method. `"keypair"` is the only supported value and the default, so passing it explicitly is the same as omitting it. Retained so callers that pass `auth_method="keypair"` keep working. `"password"` is accepted but ignored, with a logged warning naming the fix; any other value raises `ValueError`.
 - **_creation_mode_** : Either a `"CreationMode.X"` string or a `snowflake.ml.feature_store.CreationMode` member.
 - **_profiles_path_** : Override the dbt `profiles.yml` location. Only used on the local path.
 
+> **CI authentication** uses key-pair auth exclusively — see `snowflake_engine_factory` for the env var names and base64 encoding details.
+
 #### Returns
 - A `snowflake.ml.feature_store.FeatureStore`. The underlying Snowpark session is reachable as `fs._session` and is not closed by this function.
 

{gitlabds-2.3.1 → gitlabds-2.4.0}/README.md

@@ -1099,7 +1099,7 @@ feature_drift = results['feature_drift']
 
 #### Snowflake Connectors
 
-Thin wrappers over the native Snowflake SDKs that resolve GitLab's two credential paths — local (dbt profile + SSO) and GitLab CI (env vars + password or key pair) — and then hand off to the native objects. Migrated from `gitlabdata.orchestration_utils`; see the migration notes at the end of this section.
+Thin wrappers over the native Snowflake SDKs that resolve GitLab's two credential paths — local (dbt profile + SSO) and GitLab CI (env vars + key-pair auth) — and then hand off to the native objects. Migrated from `gitlabdata.orchestration_utils`; see the migration notes at the end of this section.
 
 All of these require `pip install gitlabds[snowflake]`.
 
@@ -1108,7 +1108,7 @@ All of these require `pip install gitlabds[snowflake]`.
 #### Description
 Open a Snowflake connection, resolving credentials from your dbt profile locally or from GitLab CI environment variables in CI.
 
-`gitlabds.snowflake_engine_factory(args=None, role="DATA_SCIENCE_LOADER", run_target=None, profile_target="dev", schema="", auth_method="password", profiles_path=None, **connect_kwargs):`
+`gitlabds.snowflake_engine_factory(args=None, role="DATA_SCIENCE_LOADER", run_target=None, profile_target="dev", schema="", auth_method="keypair", profiles_path=None, **connect_kwargs):`
 
 #### Parameters:
 - **_args_** : Environment mapping to read CI credentials from. Defaults to `os.environ`. Ignored on the local path.
@@ -1116,10 +1116,12 @@ Open a Snowflake connection, resolving credentials from your dbt profile locally
 - **_run_target_** : `"local"` or `"ci"`. Inferred from the `GITLAB_CI` environment variable when not given.
 - **_profile_target_** : dbt profile output name. Only used on the local path.
 - **_schema_** : Schema to connect to. Falls back to the dbt profile's schema locally; when it resolves empty the connection is opened with no default schema.
-- **_auth_method_** : `"password"` or `"keypair"`. Only used on the CI path. Key pair secrets are not yet provisioned in CI.
+- **_auth_method_** : CI authentication method. `"keypair"` is the only supported value and the default, so passing it explicitly is the same as omitting it. Retained so callers that pass `auth_method="keypair"` keep working. `"password"` is accepted but ignored, with a logged warning naming the fix; any other value raises `ValueError`.
 - **_profiles_path_** : Override the dbt `profiles.yml` location (defaults to `~/.dbt/profiles.yml`). Only used on the local path.
 - **_\*\*connect_kwargs_** : Passed through to `snowflake.connector.connect()`, e.g. `autocommit=False`, `client_session_keep_alive=True`.
 
+> **CI authentication** uses key-pair auth exclusively (password-based CI auth was removed ahead of Snowflake's 2026-09-22 service-user password deprecation). In CI, reads `SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY` (raw PEM or base64-encoded PEM — base64 is required for GitLab CI/CD variables since multi-line values cannot be masked) and optionally `SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY_PASSPHRASE` (or the `_PASSWORD` variant) for encrypted keys.
+
 #### Returns
 - An open `snowflake.connector.SnowflakeConnection`. The caller owns its lifecycle.
 
@@ -1264,17 +1266,19 @@ gitlabds.snowflake_stage_load_copy_remove(
 #### Description
 Create a Snowflake Feature Store connection (Snowpark Session + native `FeatureStore`), resolving credentials the same way as `snowflake_engine_factory`.
 
-`gitlabds.feature_store_factory(args=None, role="DATA_SCIENCE_LOADER", run_target=None, profile_target="feature_store", auth_method="password", creation_mode="CreationMode.FAIL_IF_NOT_EXIST", profiles_path=None):`
+`gitlabds.feature_store_factory(args=None, role="DATA_SCIENCE_LOADER", run_target=None, profile_target="feature_store", auth_method="keypair", creation_mode="CreationMode.FAIL_IF_NOT_EXIST", profiles_path=None):`
 
 #### Parameters:
 - **_args_** : Environment mapping to read CI credentials from. Defaults to `os.environ`. Ignored on the local path.
 - **_role_** : Snowflake role for CI credentials. The feature store's database and schema come from `SNOWFLAKE_FEATURE_STORE_DATABASE` / `SNOWFLAKE_FEATURE_STORE_SCHEMA` on the CI path, not from the role's usual database/schema.
 - **_run_target_** : `"local"` or `"ci"`. Inferred from the `GITLAB_CI` environment variable when not given.
 - **_profile_target_** : dbt profile output name. Only used on the local path.
-- **_auth_method_** : `"password"` or `"keypair"`. Only used on the CI path.
+- **_auth_method_** : CI authentication method. `"keypair"` is the only supported value and the default, so passing it explicitly is the same as omitting it. Retained so callers that pass `auth_method="keypair"` keep working. `"password"` is accepted but ignored, with a logged warning naming the fix; any other value raises `ValueError`.
 - **_creation_mode_** : Either a `"CreationMode.X"` string or a `snowflake.ml.feature_store.CreationMode` member.
 - **_profiles_path_** : Override the dbt `profiles.yml` location. Only used on the local path.
 
+> **CI authentication** uses key-pair auth exclusively — see `snowflake_engine_factory` for the env var names and base64 encoding details.
+
 #### Returns
 - A `snowflake.ml.feature_store.FeatureStore`. The underlying Snowpark session is reachable as `fs._session` and is not closed by this function.
 

{gitlabds-2.3.1 → gitlabds-2.4.0}/gitlabds/snowflake_connectors.py

@@ -4,7 +4,7 @@ Snowflake connectors for Data Science pipelines.
 Thin wrappers around the native Snowflake SDKs (snowflake-connector-python,
 snowflake-snowpark-python, snowflake-ml-python) that resolve GitLab's two
 credential paths -- local (dbt profile + SSO) and GitLab CI (env vars +
-password or key pair) -- so callers don't need to reimplement that branch.
+key-pair auth) -- so callers don't need to reimplement that branch.
 The native SDK objects (SnowflakeConnection, Session, FeatureStore) do the
 actual connecting; this module only decides which credentials to hand them.
 
@@ -12,6 +12,7 @@ Requires the optional Snowflake dependencies: pip install gitlabds[snowflake]
 
 """
 
+import base64
 import logging
 import os
 from pathlib import Path
@@ -39,18 +40,15 @@ DOCKER_PROFILES_PATH = "/usr/local/snowflake_profile/profiles.yml"
 _CI_ROLE_VARS: Dict[str, Dict[str, str]] = {
     "DATA_SCIENCE_LOADER": {
         "user": "SNOWFLAKE_DATA_SCIENCE_LOAD_USER",
-        "password": "SNOWFLAKE_DATA_SCIENCE_LOAD_PASSWORD",
         "private_key": "SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY",
         "private_key_password": "SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY_PASSWORD",
+        "private_key_passphrase": "SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY_PASSPHRASE",
         "account": "SNOWFLAKE_ACCOUNT",
         "database": "SNOWFLAKE_PROD_DATABASE",
         "warehouse": "SNOWFLAKE_LOAD_WAREHOUSE",
     },
 }
 
-# The private_key env vars are not provisioned in CI yet, so auth_method="keypair"
-# will report them missing. Password auth remains the default.
-
 
 def _dbt_profile_config(
     profile_target: str, profiles_path: Optional[Union[str, Path]] = None
@@ -78,9 +76,53 @@ def _dbt_profile_config(
 
 
 def _private_key_der(private_key_pem: str, password: Optional[str] = None) -> bytes:
-    """Convert a PEM-encoded private key to the DER/PKCS8 bytes Snowflake expects."""
+    """
+    Convert a PEM private key to the DER/PKCS8 bytes Snowflake expects.
+
+    Accepts either a raw PEM string (starts with ``-----BEGIN``) or a
+    base64-encoded PEM string.  Base64 encoding is required when the key is
+    stored in a GitLab CI/CD variable, because GitLab cannot mask multi-line
+    values; callers should base64-encode the PEM before storing it and this
+    function will decode it transparently.
+
+    Parameters
+    ----------
+    private_key_pem : str
+        Raw PEM string or base64-encoded PEM string.
+    password : str, optional
+        Passphrase protecting the private key, if any.
+
+    Returns
+    -------
+    bytes
+        Unencrypted DER-encoded private key bytes suitable for
+        ``snowflake.connector.connect(private_key=...)``.
+
+    Raises
+    ------
+    ValueError
+        When the input is neither a valid PEM string nor valid base64-encoded
+        PEM.
+    """
+    pem_str = private_key_pem.strip()
+    if pem_str.startswith("-----BEGIN"):
+        pem_bytes = pem_str.encode("utf-8")
+    else:
+        try:
+            pem_bytes = base64.b64decode(pem_str)
+        except Exception:
+            raise ValueError(
+                "private_key is neither a valid PEM string (expected to start with "
+                "'-----BEGIN') nor valid base64-encoded PEM. "
+                "Encode the PEM key with base64 before storing it in a CI/CD variable."
+            )
+        if not pem_bytes.lstrip().startswith(b"-----BEGIN"):
+            raise ValueError(
+                "private_key decoded from base64 is not a valid PEM string. "
+                "Encode the PEM key with base64 before storing it in a CI/CD variable."
+            )
     key = load_pem_private_key(
-        private_key_pem.encode("utf-8"),
+        pem_bytes,
         password=password.encode("utf-8") if password else None,
         backend=default_backend(),
     )
@@ -103,7 +145,8 @@ def _resolve_connect_params(
     """
     Build connect() / Session.builder.configs() kwargs for either credential path.
 
-    "local" reads the dbt profile and uses SSO; "ci" reads env vars for `role`.
+    "local" reads the dbt profile and uses SSO; "ci" reads env vars for `role`
+    and uses key-pair authentication -- the only CI method still supported.
     The schema key is omitted when it resolves empty, so the connection gets no
     default schema rather than one named "".
     """
@@ -131,14 +174,25 @@ def _resolve_connect_params(
         raise ValueError(f"run_target must be 'local' or 'ci', got {run_target!r}")
     if role not in _CI_ROLE_VARS:
         raise ValueError(f"Unknown role {role!r} for CI auth. Known roles: {sorted(_CI_ROLE_VARS)}")
-    if auth_method not in ("password", "keypair"):
-        raise ValueError(f"auth_method must be 'password' or 'keypair', got {auth_method!r}")
+    if auth_method == "password":
+        # Don't fail the run: password auth stops working at Snowflake's
+        # 2026-09-22 deadline anyway, so key-pair is the only thing that could
+        # succeed. Warn loudly and use it.
+        logger.warning(
+            "auth_method='password' is no longer supported and was ignored; connecting "
+            "with key-pair auth instead. Password-based CI authentication was removed "
+            "ahead of Snowflake's 2026-09-22 service-user password deprecation. To fix: "
+            "change auth_method='password' to auth_method='keypair' (or drop the "
+            "parameter -- 'keypair' is the default) and set %s in your CI/CD variables.",
+            _CI_ROLE_VARS[role]["private_key"],
+        )
+    elif auth_method != "keypair":
+        raise ValueError(f"auth_method must be 'keypair', got {auth_method!r}")
 
     var_names = _CI_ROLE_VARS[role]
-    credential = "private_key" if auth_method == "keypair" else "password"
     missing = [
         var_names[key]
-        for key in ("user", "account", "database", "warehouse", credential)
+        for key in ("user", "account", "database", "warehouse", "private_key")
         if not env.get(var_names[key])
     ]
     if missing:
@@ -155,12 +209,14 @@ def _resolve_connect_params(
     )
     if schema:
         params["schema"] = schema
-    if auth_method == "keypair":
-        params["private_key"] = _private_key_der(
-            env[var_names["private_key"]], env.get(var_names["private_key_password"])
-        )
-    else:
-        params["password"] = env[var_names["password"]]
+    # Accept either _PASSWORD or _PASSPHRASE; the group CI/CD variable uses
+    # the _PASSPHRASE suffix, which is also the more accurate term.
+    key_passphrase = env.get(var_names["private_key_password"]) or env.get(
+        var_names["private_key_passphrase"]
+    )
+    params["private_key"] = _private_key_der(
+        env[var_names["private_key"]], key_passphrase
+    )
     return params
 
 
@@ -170,7 +226,7 @@ def snowflake_engine_factory(
     run_target: Optional[str] = None,
     profile_target: str = "dev",
     schema: str = "",
-    auth_method: str = "password",
+    auth_method: str = "keypair",
     profiles_path: Optional[Union[str, Path]] = None,
     **connect_kwargs: Any,
 ) -> SnowflakeConnection:
@@ -192,8 +248,13 @@ def snowflake_engine_factory(
         dbt profile output name. Only used on the local path.
     schema : str, default=""
         Schema to connect to. Falls back to the dbt profile's schema locally.
-    auth_method : str, default="password"
-        "password" or "keypair". Only used on the CI path.
+    auth_method : str, default="keypair"
+        Authentication method for the CI path. Only "keypair" is supported, so
+        passing it explicitly is equivalent to omitting it. Retained for
+        backward compatibility with callers that pass auth_method="keypair".
+        "password" is accepted but ignored with a warning -- password-based CI
+        auth was removed ahead of Snowflake's 2026-09-22 service-user password
+        deprecation. Any other value raises ValueError.
     profiles_path : str or Path, optional
         Override the dbt profiles.yml location. Only used on the local path.
     **connect_kwargs
@@ -366,7 +427,7 @@ def feature_store_factory(
     role: str = "DATA_SCIENCE_LOADER",
     run_target: Optional[str] = None,
     profile_target: str = "feature_store",
-    auth_method: str = "password",
+    auth_method: str = "keypair",
     creation_mode: str = "CreationMode.FAIL_IF_NOT_EXIST",
     profiles_path: Optional[Union[str, Path]] = None,
 ) -> "FeatureStore":  # noqa: F821
@@ -387,8 +448,13 @@ def feature_store_factory(
         not given.
     profile_target : str, default="feature_store"
         dbt profile output name. Only used on the local path.
-    auth_method : str, default="password"
-        "password" or "keypair". Only used on the CI path.
+    auth_method : str, default="keypair"
+        Authentication method for the CI path. Only "keypair" is supported, so
+        passing it explicitly is equivalent to omitting it. Retained for
+        backward compatibility with callers that pass auth_method="keypair".
+        "password" is accepted but ignored with a warning -- password-based CI
+        auth was removed ahead of Snowflake's 2026-09-22 service-user password
+        deprecation. Any other value raises ValueError.
     creation_mode : str or CreationMode, default="CreationMode.FAIL_IF_NOT_EXIST"
         Either a "CreationMode.X" string or a CreationMode member.
     profiles_path : str or Path, optional

{gitlabds-2.3.1 → gitlabds-2.4.0}/gitlabds.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitlabds
-Version: 2.3.1
+Version: 2.4.0
 Summary: GitLab Data Science Tools
 Author-email: Kevin Dietz <kdietz@gitlab.com>
 License-Expression: MIT
@@ -1135,7 +1135,7 @@ feature_drift = results['feature_drift']
 
 #### Snowflake Connectors
 
-Thin wrappers over the native Snowflake SDKs that resolve GitLab's two credential paths — local (dbt profile + SSO) and GitLab CI (env vars + password or key pair) — and then hand off to the native objects. Migrated from `gitlabdata.orchestration_utils`; see the migration notes at the end of this section.
+Thin wrappers over the native Snowflake SDKs that resolve GitLab's two credential paths — local (dbt profile + SSO) and GitLab CI (env vars + key-pair auth) — and then hand off to the native objects. Migrated from `gitlabdata.orchestration_utils`; see the migration notes at the end of this section.
 
 All of these require `pip install gitlabds[snowflake]`.
 
@@ -1144,7 +1144,7 @@ All of these require `pip install gitlabds[snowflake]`.
 #### Description
 Open a Snowflake connection, resolving credentials from your dbt profile locally or from GitLab CI environment variables in CI.
 
-`gitlabds.snowflake_engine_factory(args=None, role="DATA_SCIENCE_LOADER", run_target=None, profile_target="dev", schema="", auth_method="password", profiles_path=None, **connect_kwargs):`
+`gitlabds.snowflake_engine_factory(args=None, role="DATA_SCIENCE_LOADER", run_target=None, profile_target="dev", schema="", auth_method="keypair", profiles_path=None, **connect_kwargs):`
 
 #### Parameters:
 - **_args_** : Environment mapping to read CI credentials from. Defaults to `os.environ`. Ignored on the local path.
@@ -1152,10 +1152,12 @@ Open a Snowflake connection, resolving credentials from your dbt profile locally
 - **_run_target_** : `"local"` or `"ci"`. Inferred from the `GITLAB_CI` environment variable when not given.
 - **_profile_target_** : dbt profile output name. Only used on the local path.
 - **_schema_** : Schema to connect to. Falls back to the dbt profile's schema locally; when it resolves empty the connection is opened with no default schema.
-- **_auth_method_** : `"password"` or `"keypair"`. Only used on the CI path. Key pair secrets are not yet provisioned in CI.
+- **_auth_method_** : CI authentication method. `"keypair"` is the only supported value and the default, so passing it explicitly is the same as omitting it. Retained so callers that pass `auth_method="keypair"` keep working. `"password"` is accepted but ignored, with a logged warning naming the fix; any other value raises `ValueError`.
 - **_profiles_path_** : Override the dbt `profiles.yml` location (defaults to `~/.dbt/profiles.yml`). Only used on the local path.
 - **_\*\*connect_kwargs_** : Passed through to `snowflake.connector.connect()`, e.g. `autocommit=False`, `client_session_keep_alive=True`.
 
+> **CI authentication** uses key-pair auth exclusively (password-based CI auth was removed ahead of Snowflake's 2026-09-22 service-user password deprecation). In CI, reads `SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY` (raw PEM or base64-encoded PEM — base64 is required for GitLab CI/CD variables since multi-line values cannot be masked) and optionally `SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY_PASSPHRASE` (or the `_PASSWORD` variant) for encrypted keys.
+
 #### Returns
 - An open `snowflake.connector.SnowflakeConnection`. The caller owns its lifecycle.
 
@@ -1300,17 +1302,19 @@ gitlabds.snowflake_stage_load_copy_remove(
 #### Description
 Create a Snowflake Feature Store connection (Snowpark Session + native `FeatureStore`), resolving credentials the same way as `snowflake_engine_factory`.
 
-`gitlabds.feature_store_factory(args=None, role="DATA_SCIENCE_LOADER", run_target=None, profile_target="feature_store", auth_method="password", creation_mode="CreationMode.FAIL_IF_NOT_EXIST", profiles_path=None):`
+`gitlabds.feature_store_factory(args=None, role="DATA_SCIENCE_LOADER", run_target=None, profile_target="feature_store", auth_method="keypair", creation_mode="CreationMode.FAIL_IF_NOT_EXIST", profiles_path=None):`
 
 #### Parameters:
 - **_args_** : Environment mapping to read CI credentials from. Defaults to `os.environ`. Ignored on the local path.
 - **_role_** : Snowflake role for CI credentials. The feature store's database and schema come from `SNOWFLAKE_FEATURE_STORE_DATABASE` / `SNOWFLAKE_FEATURE_STORE_SCHEMA` on the CI path, not from the role's usual database/schema.
 - **_run_target_** : `"local"` or `"ci"`. Inferred from the `GITLAB_CI` environment variable when not given.
 - **_profile_target_** : dbt profile output name. Only used on the local path.
-- **_auth_method_** : `"password"` or `"keypair"`. Only used on the CI path.
+- **_auth_method_** : CI authentication method. `"keypair"` is the only supported value and the default, so passing it explicitly is the same as omitting it. Retained so callers that pass `auth_method="keypair"` keep working. `"password"` is accepted but ignored, with a logged warning naming the fix; any other value raises `ValueError`.
 - **_creation_mode_** : Either a `"CreationMode.X"` string or a `snowflake.ml.feature_store.CreationMode` member.
 - **_profiles_path_** : Override the dbt `profiles.yml` location. Only used on the local path.
 
+> **CI authentication** uses key-pair auth exclusively — see `snowflake_engine_factory` for the env var names and base64 encoding details.
+
 #### Returns
 - A `snowflake.ml.feature_store.FeatureStore`. The underlying Snowpark session is reachable as `fs._session` and is not closed by this function.
 

{gitlabds-2.3.1 → gitlabds-2.4.0}/tests/test_snowflake_connectors.py

@@ -65,14 +65,21 @@ class FakeConnection:
         return self._cursor
 
 
-CI_ENV = {
+# CI_ENV_BASE intentionally omits SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY so that
+# individual tests can inject a freshly-generated key via rsa_pem.  Tests that
+# need a fully-valid CI env build one with make_ci_env(rsa_pem).
+CI_ENV_BASE = {
     "SNOWFLAKE_DATA_SCIENCE_LOAD_USER": "ds_user",
-    "SNOWFLAKE_DATA_SCIENCE_LOAD_PASSWORD": "ds_password",
     "SNOWFLAKE_ACCOUNT": "gitlab_account",
     "SNOWFLAKE_PROD_DATABASE": "PROD",
     "SNOWFLAKE_LOAD_WAREHOUSE": "LOADING",
 }
 
+
+def make_ci_env(private_key_pem: str) -> dict:
+    """Return a complete CI env dict with the given PEM key."""
+    return dict(CI_ENV_BASE, SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY=private_key_pem)
+
 PROFILE = {
     "user": "kdietz@gitlab.com",
     "account": "gitlab_account",
@@ -131,9 +138,9 @@ class TestCiRoleVars:
     def test_data_science_loader_env_var_names(self):
         assert sc._CI_ROLE_VARS["DATA_SCIENCE_LOADER"] == {
             "user": "SNOWFLAKE_DATA_SCIENCE_LOAD_USER",
-            "password": "SNOWFLAKE_DATA_SCIENCE_LOAD_PASSWORD",
             "private_key": "SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY",
             "private_key_password": "SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY_PASSWORD",
+            "private_key_passphrase": "SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY_PASSPHRASE",
             "account": "SNOWFLAKE_ACCOUNT",
             "database": "SNOWFLAKE_PROD_DATABASE",
             "warehouse": "SNOWFLAKE_LOAD_WAREHOUSE",
@@ -184,6 +191,7 @@ class TestDbtProfileConfig:
 
 class TestPrivateKeyDer:
     def test_unencrypted_pem_round_trips_to_der(self, rsa_pem):
+        """Raw PEM input (existing behavior) must keep working."""
         der = sc._private_key_der(rsa_pem)
         assert isinstance(der, bytes)
         assert serialization.load_der_private_key(der, password=None).key_size == 2048
@@ -197,6 +205,43 @@ class TestPrivateKeyDer:
         with pytest.raises(ValueError):
             sc._private_key_der(encrypted_pem(b"hunter2"), password="wrong")
 
+    def test_base64_encoded_pem_is_accepted(self, rsa_pem):
+        """GitLab CI/CD variables cannot mask multi-line PEM; base64 is the workaround."""
+        import base64
+
+        b64_pem = base64.b64encode(rsa_pem.encode("utf-8")).decode("utf-8")
+        assert not b64_pem.startswith("-----BEGIN")
+        der = sc._private_key_der(b64_pem)
+        assert isinstance(der, bytes)
+        assert serialization.load_der_private_key(der, password=None).key_size == 2048
+
+    def test_base64_encoded_encrypted_pem_is_accepted(self):
+        """Base64-encoded encrypted PEM with a passphrase must also work."""
+        import base64
+
+        pem = encrypted_pem(b"hunter2")
+        b64_pem = base64.b64encode(pem.encode("utf-8")).decode("utf-8")
+        der = sc._private_key_der(b64_pem, password="hunter2")
+        assert serialization.load_der_private_key(der, password=None) is not None
+
+    def test_invalid_input_raises_clear_value_error(self):
+        """Garbage input must raise ValueError with a helpful message, not an opaque crypto error."""
+        with pytest.raises(ValueError, match="neither a valid PEM string.*nor valid base64-encoded PEM"):
+            sc._private_key_der("this-is-not-a-key")
+
+    def test_base64_of_non_pem_raises_clear_value_error(self):
+        """base64('hello world') decodes fine but is not a PEM -- must raise clearly."""
+        import base64
+
+        b64_garbage = base64.b64encode(b"hello world").decode("utf-8")
+        with pytest.raises(ValueError, match="not a valid PEM string"):
+            sc._private_key_der(b64_garbage)
+
+    def test_raw_pem_with_leading_whitespace_is_accepted(self, rsa_pem):
+        """strip() must handle leading/trailing whitespace that CI env vars sometimes add."""
+        der = sc._private_key_der("\n" + rsa_pem + "\n")
+        assert serialization.load_der_private_key(der, password=None).key_size == 2048
+
 
 # ---------------------------------------------------------------------------
 # _resolve_connect_params -- local path
@@ -206,7 +251,7 @@ class TestPrivateKeyDer:
 class TestResolveConnectParamsLocal:
     def _resolve(self, profiles_file, schema="", profile_target="dev"):
         return sc._resolve_connect_params(
-            "local", "DATA_SCIENCE_LOADER", profile_target, schema, "password", {}, profiles_file
+            "local", "DATA_SCIENCE_LOADER", profile_target, schema, "keypair", {}, profiles_file
         )
 
     def test_uses_sso(self, profiles_file):
@@ -252,94 +297,140 @@ class TestResolveConnectParamsLocal:
 
 
 class TestResolveConnectParamsCi:
-    def _resolve(self, env=None, role="DATA_SCIENCE_LOADER", schema="", auth_method="password"):
+    def _resolve(self, rsa_pem, env=None, role="DATA_SCIENCE_LOADER", schema="", auth_method="keypair"):
         return sc._resolve_connect_params(
-            "ci", role, "dev", schema, auth_method, env if env is not None else dict(CI_ENV)
+            "ci", role, "dev", schema, auth_method, env if env is not None else make_ci_env(rsa_pem)
         )
 
-    def test_reads_the_roles_env_vars(self):
-        params = self._resolve()
+    def test_reads_the_roles_env_vars(self, rsa_pem):
+        params = self._resolve(rsa_pem)
         assert params["user"] == "ds_user"
-        assert params["password"] == "ds_password"
+        assert isinstance(params["private_key"], bytes)
+        assert "password" not in params
         assert params["account"] == "gitlab_account"
         assert params["database"] == "PROD"
         assert params["warehouse"] == "LOADING"
         assert params["role"] == "DATA_SCIENCE_LOADER"
 
-    def test_never_uses_sso(self):
-        assert "authenticator" not in self._resolve()
+    def test_never_uses_sso(self, rsa_pem):
+        assert "authenticator" not in self._resolve(rsa_pem)
 
-    def test_schema_is_included_when_given(self):
-        assert self._resolve(schema="data_science")["schema"] == "data_science"
+    def test_schema_is_included_when_given(self, rsa_pem):
+        assert self._resolve(rsa_pem, schema="data_science")["schema"] == "data_science"
 
-    def test_schema_key_is_omitted_when_empty(self):
-        assert "schema" not in self._resolve()
+    def test_schema_key_is_omitted_when_empty(self, rsa_pem):
+        assert "schema" not in self._resolve(rsa_pem)
 
     def test_invalid_run_target_raises(self):
         with pytest.raises(ValueError, match="run_target must be 'local' or 'ci'"):
-            sc._resolve_connect_params("prod", "DATA_SCIENCE_LOADER", "dev", "", "password", {})
+            sc._resolve_connect_params("prod", "DATA_SCIENCE_LOADER", "dev", "", "keypair", {})
 
-    def test_unknown_role_lists_the_known_ones(self):
+    def test_password_auth_method_warns_and_falls_back_to_keypair(self, rsa_pem, caplog):
+        """
+        Password auth is gone, but failing the run helps nobody -- key-pair is the
+        only method that can succeed. Warn with the fix and connect anyway.
+        """
+        with caplog.at_level(logging.WARNING, logger="gitlabds.snowflake_connectors"):
+            params = self._resolve(rsa_pem, auth_method="password")
+        assert isinstance(params["private_key"], bytes)
+        assert "password" not in params
+        assert "auth_method='password' is no longer supported" in caplog.text
+
+    def test_password_warning_names_the_fix_and_the_env_var(self, rsa_pem, caplog):
+        with caplog.at_level(logging.WARNING, logger="gitlabds.snowflake_connectors"):
+            self._resolve(rsa_pem, auth_method="password")
+        assert "auth_method='keypair'" in caplog.text
+        assert "SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY" in caplog.text
+
+    def test_keypair_is_silent(self, rsa_pem, caplog):
+        """The supported call style must not nag."""
+        with caplog.at_level(logging.WARNING, logger="gitlabds.snowflake_connectors"):
+            self._resolve(rsa_pem, auth_method="keypair")
+        assert caplog.text == ""
+
+    def test_unknown_auth_method_raises(self, rsa_pem):
+        """Only 'keypair' is accepted; anything else must fail."""
+        with pytest.raises(ValueError, match="auth_method must be 'keypair'"):
+            self._resolve(rsa_pem, auth_method="oauth")
+
+    def test_unknown_role_lists_the_known_ones(self, rsa_pem):
         with pytest.raises(ValueError, match="Unknown role 'NOPE' for CI auth"):
-            self._resolve(role="NOPE")
-
-    def test_unknown_auth_method_raises(self):
-        with pytest.raises(ValueError, match="auth_method must be 'password' or 'keypair'"):
-            self._resolve(auth_method="oauth")
+            self._resolve(rsa_pem, role="NOPE")
 
     @pytest.mark.parametrize(
         "missing_var",
         [
             "SNOWFLAKE_DATA_SCIENCE_LOAD_USER",
-            "SNOWFLAKE_DATA_SCIENCE_LOAD_PASSWORD",
+            "SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY",
             "SNOWFLAKE_ACCOUNT",
             "SNOWFLAKE_PROD_DATABASE",
             "SNOWFLAKE_LOAD_WAREHOUSE",
         ],
     )
-    def test_each_missing_credential_names_itself(self, missing_var):
-        env = {k: v for k, v in CI_ENV.items() if k != missing_var}
+    def test_each_missing_credential_names_itself(self, rsa_pem, missing_var):
+        env = {k: v for k, v in make_ci_env(rsa_pem).items() if k != missing_var}
         with pytest.raises(ValueError, match=missing_var):
-            self._resolve(env=env)
+            self._resolve(rsa_pem, env=env)
 
-    def test_empty_credential_counts_as_missing(self):
+    def test_empty_private_key_counts_as_missing(self, rsa_pem):
         """An env var set to "" in CI is a misconfiguration, not a valid credential."""
-        env = dict(CI_ENV, SNOWFLAKE_DATA_SCIENCE_LOAD_PASSWORD="")
-        with pytest.raises(ValueError, match="SNOWFLAKE_DATA_SCIENCE_LOAD_PASSWORD"):
-            self._resolve(env=env)
+        env = dict(make_ci_env(rsa_pem), SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY="")
+        with pytest.raises(ValueError, match="SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY"):
+            self._resolve(rsa_pem, env=env)
 
-    def test_all_missing_variables_are_reported_at_once(self):
+    def test_all_missing_variables_are_reported_at_once(self, rsa_pem):
         with pytest.raises(ValueError) as exc:
-            self._resolve(env={})
+            self._resolve(rsa_pem, env={})
         message = str(exc.value)
         assert "SNOWFLAKE_DATA_SCIENCE_LOAD_USER" in message
         assert "SNOWFLAKE_ACCOUNT" in message
         assert "SNOWFLAKE_LOAD_WAREHOUSE" in message
 
-    def test_keypair_sends_der_bytes_and_no_password(self, rsa_pem):
-        env = dict(CI_ENV, SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY=rsa_pem)
-        params = self._resolve(env=env, auth_method="keypair")
+    def test_sends_der_bytes_and_no_password(self, rsa_pem):
+        params = self._resolve(rsa_pem)
         assert isinstance(params["private_key"], bytes)
         assert "password" not in params
 
-    def test_keypair_uses_the_key_password_when_present(self):
+    def test_uses_the_key_password_when_present(self):
         env = dict(
-            CI_ENV,
+            CI_ENV_BASE,
             SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY=encrypted_pem(b"s3cret"),
             SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY_PASSWORD="s3cret",
         )
-        assert isinstance(self._resolve(env=env, auth_method="keypair")["private_key"], bytes)
+        assert isinstance(self._resolve(None, env=env)["private_key"], bytes)
 
-    def test_keypair_without_the_secret_names_the_variable(self):
-        """Key pair vars are not provisioned in CI yet -- fail with a named var."""
-        with pytest.raises(ValueError, match="SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY"):
-            self._resolve(auth_method="keypair")
+    def test_passphrase_env_var_is_accepted_as_fallback(self):
+        """SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY_PASSPHRASE is the actual group CI/CD
+        variable name; gitlabds must accept it when the _PASSWORD variant is absent."""
+        env = dict(
+            CI_ENV_BASE,
+            SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY=encrypted_pem(b"s3cret"),
+            SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY_PASSPHRASE="s3cret",
+        )
+        params = self._resolve(None, env=env)
+        assert isinstance(params["private_key"], bytes)
+
+    def test_password_takes_precedence_over_passphrase(self):
+        """When both _PASSWORD and _PASSPHRASE are set, _PASSWORD wins."""
+        env = dict(
+            CI_ENV_BASE,
+            SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY=encrypted_pem(b"s3cret"),
+            SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY_PASSWORD="s3cret",
+            SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY_PASSPHRASE="wrong",
+        )
+        # If _PASSWORD is used (correct), decryption succeeds; if _PASSPHRASE is
+        # used instead, it would fail with a ValueError.
+        params = self._resolve(None, env=env)
+        assert isinstance(params["private_key"], bytes)
 
-    def test_keypair_does_not_require_a_password_variable(self, rsa_pem):
-        env = dict(CI_ENV, SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY=rsa_pem)
-        del env["SNOWFLAKE_DATA_SCIENCE_LOAD_PASSWORD"]
-        assert "private_key" in self._resolve(env=env, auth_method="keypair")
+    def test_base64_pem_via_env_var(self, rsa_pem):
+        """End-to-end: a base64-encoded PEM stored in the CI env var resolves correctly."""
+        import base64
 
+        b64_pem = base64.b64encode(rsa_pem.encode("utf-8")).decode("utf-8")
+        env = dict(CI_ENV_BASE, SNOWFLAKE_DATA_SCIENCE_LOAD_PRIVATE_KEY=b64_pem)
+        params = self._resolve(rsa_pem, env=env)
+        assert isinstance(params["private_key"], bytes)
 
 # ---------------------------------------------------------------------------
 # snowflake_engine_factory
@@ -363,26 +454,32 @@ class TestSnowflakeEngineFactory:
         sc.snowflake_engine_factory(profiles_path=profiles_file)
         assert captured_connect["authenticator"] == "externalbrowser"
 
-    def test_ci_path_when_gitlab_ci_is_set(self, captured_connect, monkeypatch):
+    def test_ci_path_when_gitlab_ci_is_set(self, captured_connect, monkeypatch, rsa_pem):
         monkeypatch.setenv("GITLAB_CI", "true")
-        sc.snowflake_engine_factory(args=CI_ENV)
+        sc.snowflake_engine_factory(args=make_ci_env(rsa_pem))
         assert captured_connect["user"] == "ds_user"
         assert "authenticator" not in captured_connect
 
-    def test_ci_is_detected_even_when_args_omits_gitlab_ci(self, captured_connect, monkeypatch):
+    def test_ci_is_detected_even_when_args_omits_gitlab_ci(
+        self, captured_connect, monkeypatch, rsa_pem
+    ):
         """
         Regression: inference must read os.environ, not `args`. A caller passing a
         curated credential dict in CI used to be routed to the local SSO path and
         hang on browser auth.
         """
         monkeypatch.setenv("GITLAB_CI", "true")
-        sc.snowflake_engine_factory(args=dict(CI_ENV))  # no GITLAB_CI key inside
+        sc.snowflake_engine_factory(args=make_ci_env(rsa_pem))  # no GITLAB_CI key inside
         assert "authenticator" not in captured_connect
-        assert captured_connect["password"] == "ds_password"
+        assert isinstance(captured_connect["private_key"], bytes)
 
-    def test_gitlab_ci_inside_args_does_not_force_the_ci_path(self, captured_connect, profiles_file):
+    def test_gitlab_ci_inside_args_does_not_force_the_ci_path(
+        self, captured_connect, profiles_file, rsa_pem
+    ):
         """The converse: a stray GITLAB_CI in the passed dict is not a CI signal."""
-        sc.snowflake_engine_factory(args=dict(CI_ENV, GITLAB_CI="true"), profiles_path=profiles_file)
+        sc.snowflake_engine_factory(
+            args=dict(make_ci_env(rsa_pem), GITLAB_CI="true"), profiles_path=profiles_file
+        )
         assert captured_connect["authenticator"] == "externalbrowser"
 
     def test_explicit_run_target_wins_over_inference(
@@ -392,9 +489,9 @@ class TestSnowflakeEngineFactory:
         sc.snowflake_engine_factory(run_target="local", profiles_path=profiles_file)
         assert captured_connect["authenticator"] == "externalbrowser"
 
-    def test_defaults_args_to_os_environ(self, captured_connect, monkeypatch):
+    def test_defaults_args_to_os_environ(self, captured_connect, monkeypatch, rsa_pem):
         monkeypatch.setenv("GITLAB_CI", "true")
-        for name, value in CI_ENV.items():
+        for name, value in make_ci_env(rsa_pem).items():
             monkeypatch.setenv(name, value)
         sc.snowflake_engine_factory()  # no args passed at all
         assert captured_connect["user"] == "ds_user"
@@ -423,6 +520,50 @@ class TestSnowflakeEngineFactory:
         with pytest.raises(ValueError, match="run_target must be"):
             sc.snowflake_engine_factory(run_target="prod")
 
+    def test_explicit_keypair_auth_method_is_accepted(
+        self, captured_connect, monkeypatch, rsa_pem
+    ):
+        """
+        Downstream callers migrated to key-pair auth pass auth_method="keypair"
+        explicitly. Dropping the parameter would TypeError at their call site, so
+        it stays in the signature until 3.0.
+        """
+        monkeypatch.setenv("GITLAB_CI", "true")
+        sc.snowflake_engine_factory(args=make_ci_env(rsa_pem), auth_method="keypair")
+        assert isinstance(captured_connect["private_key"], bytes)
+
+    def test_auth_method_is_not_forwarded_to_connect(self, captured_connect, monkeypatch, rsa_pem):
+        """It is consumed by the signature, not swallowed into **connect_kwargs."""
+        monkeypatch.setenv("GITLAB_CI", "true")
+        sc.snowflake_engine_factory(args=make_ci_env(rsa_pem), auth_method="keypair")
+        assert "auth_method" not in captured_connect
+
+    def test_explicit_keypair_is_identical_to_omitting_it(self, monkeypatch, rsa_pem):
+        """
+        The contract downstream callers rely on: auth_method="keypair" and no
+        auth_method at all must produce the same connection.
+        """
+        monkeypatch.setenv("GITLAB_CI", "true")
+        env = make_ci_env(rsa_pem)
+        captured = []
+
+        def fake_connect(**kwargs):
+            captured.append(kwargs)
+            return FakeConnection()
+
+        monkeypatch.setattr(snowflake.connector, "connect", fake_connect)
+        sc.snowflake_engine_factory(args=env)
+        sc.snowflake_engine_factory(args=env, auth_method="keypair")
+        assert captured[0] == captured[1]
+
+    def test_password_auth_method_warns_and_still_connects(self, captured_connect, monkeypatch, rsa_pem, caplog):
+        monkeypatch.setenv("GITLAB_CI", "true")
+        with caplog.at_level(logging.WARNING, logger="gitlabds.snowflake_connectors"):
+            sc.snowflake_engine_factory(args=make_ci_env(rsa_pem), auth_method="password")
+        assert isinstance(captured_connect["private_key"], bytes)
+        assert "password" not in captured_connect
+        assert "auth_method='password' is no longer supported" in caplog.text
+
 
 # ---------------------------------------------------------------------------
 # ds_query_dataframe
@@ -739,11 +880,11 @@ class TestFeatureStoreFactory:
         assert captured_feature_store["default_warehouse"] == PROFILE["warehouse"]
 
     def test_ci_path_uses_the_dedicated_feature_store_env_vars(
-        self, captured_feature_store, monkeypatch
+        self, captured_feature_store, monkeypatch, rsa_pem
     ):
         monkeypatch.setenv("GITLAB_CI", "true")
         env = dict(
-            CI_ENV,
+            make_ci_env(rsa_pem),
             SNOWFLAKE_FEATURE_STORE_DATABASE="FS_DB",
             SNOWFLAKE_FEATURE_STORE_SCHEMA="FS_SCHEMA",
         )
@@ -753,10 +894,42 @@ class TestFeatureStoreFactory:
         # The role's own PROD database must not leak through.
         assert captured_feature_store["session_params"]["database"] == "FS_DB"
 
-    def test_ci_path_without_the_feature_store_vars_names_them(self, monkeypatch):
+    def test_explicit_keypair_auth_method_is_accepted(
+        self, captured_feature_store, monkeypatch, rsa_pem
+    ):
+        """
+        The feature-store repo calls feature_store_factory(..., auth_method="keypair")
+        in update_features.py and both notebooks; removing the parameter would break
+        every scheduled run on the next version bump.
+        """
+        monkeypatch.setenv("GITLAB_CI", "true")
+        env = dict(
+            make_ci_env(rsa_pem),
+            SNOWFLAKE_FEATURE_STORE_DATABASE="FS_DB",
+            SNOWFLAKE_FEATURE_STORE_SCHEMA="FS_SCHEMA",
+        )
+        sc.feature_store_factory(args=env, auth_method="keypair")
+        assert captured_feature_store["database"] == "FS_DB"
+        assert isinstance(captured_feature_store["session_params"]["private_key"], bytes)
+
+    def test_password_auth_method_warns_and_still_connects(
+        self, captured_feature_store, monkeypatch, rsa_pem, caplog
+    ):
+        monkeypatch.setenv("GITLAB_CI", "true")
+        env = dict(
+            make_ci_env(rsa_pem),
+            SNOWFLAKE_FEATURE_STORE_DATABASE="FS_DB",
+            SNOWFLAKE_FEATURE_STORE_SCHEMA="FS_SCHEMA",
+        )
+        with caplog.at_level(logging.WARNING, logger="gitlabds.snowflake_connectors"):
+            sc.feature_store_factory(args=env, auth_method="password")
+        assert isinstance(captured_feature_store["session_params"]["private_key"], bytes)
+        assert "auth_method='password' is no longer supported" in caplog.text
+
+    def test_ci_path_without_the_feature_store_vars_names_them(self, monkeypatch, rsa_pem):
         monkeypatch.setenv("GITLAB_CI", "true")
         with pytest.raises(ValueError, match="SNOWFLAKE_FEATURE_STORE_DATABASE"):
-            sc.feature_store_factory(args=dict(CI_ENV))
+            sc.feature_store_factory(args=make_ci_env(rsa_pem))
 
     def test_missing_schema_is_reported_clearly(self, captured_feature_store, tmp_path):
         """FeatureStore(name="") fails deep in the SDK; fail fast with context instead."""