feat: Add CI/CD workflows and PR template

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,34 @@
+## Summary
+
+<!-- Brief description of the changes -->
+
+## Change Type
+
+<!-- Mark the relevant type(s) -->
+
+- [ ] Infrastructure (snowddl/*.yaml changes)
+- [ ] Code (src/, scripts/ changes)
+- [ ] Documentation
+- [ ] Tests
+- [ ] CI/CD
+
+## Related Issues
+
+<!-- Link related issues using "Fixes #123" or "Closes #123" -->
+
+Fixes #
+
+## Test Plan
+
+<!-- Describe how you tested these changes -->
+
+- [ ] Ran `uv run pytest`
+- [ ] Ran `uv run pre-commit run --all-files`
+- [ ] Ran `uv run snowddl-plan` (for infrastructure changes)
+
+## Checklist
+
+- [ ] Tests pass locally
+- [ ] Pre-commit checks pass
+- [ ] Documentation updated (if applicable)
+- [ ] No secrets or sensitive data included

.github/labeler.yml

@@ -0,0 +1,44 @@
+# Configuration for actions/labeler
+# Maps file patterns to labels
+
+infrastructure:
+  - changed-files:
+      - any-glob-to-any-file: 'snowddl/**/*.yaml'
+
+user-change:
+  - changed-files:
+      - any-glob-to-any-file: 'snowddl/user.yaml'
+
+security:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'snowddl/*policy*.yaml'
+          - 'snowddl/authentication*.yaml'
+          - 'snowddl/network*.yaml'
+
+code:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'src/**/*.py'
+          - 'scripts/**/*.py'
+
+tests:
+  - changed-files:
+      - any-glob-to-any-file: 'tests/**'
+
+documentation:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'docs/**'
+          - '*.md'
+          - 'README.md'
+
+ci/cd:
+  - changed-files:
+      - any-glob-to-any-file: '.github/**'
+
+dependencies:
+  - changed-files:
+      - any-glob-to-any-file:
+          - 'pyproject.toml'
+          - 'uv.lock'

.github/workflows/ci.yml

@@ -0,0 +1,60 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main, v0.2]
+  push:
+    branches: [main, v0.2]
+
+jobs:
+  lint:
+    name: Lint & Format Check
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install UV
+        uses: astral-sh/setup-uv@v4
+        with:
+          version: "latest"
+
+      - name: Set up Python
+        run: uv python install 3.12
+
+      - name: Install dependencies
+        run: uv sync --all-extras --dev
+
+      - name: Run pre-commit
+        run: uv run pre-commit run --all-files
+
+  test:
+    name: Run Tests
+    runs-on: ubuntu-latest
+    needs: lint
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install UV
+        uses: astral-sh/setup-uv@v4
+        with:
+          version: "latest"
+
+      - name: Set up Python
+        run: uv python install 3.12
+
+      - name: Install dependencies
+        run: uv sync --all-extras --dev
+
+      - name: Run tests
+        run: uv run pytest -v --tb=short
+        env:
+          SNOWFLAKE_ACCOUNT: "test_account"
+          SNOWFLAKE_USER: "test_user"
+          SNOWFLAKE_PASSWORD: "test_password"
+          SNOWFLAKE_WAREHOUSE: "test_warehouse"
+          SNOWFLAKE_DATABASE: "test_database"
+          SNOWFLAKE_ROLE: "test_role"

.github/workflows/labeler.yml

@@ -0,0 +1,22 @@
+name: PR Labeler
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  label:
+    name: Label PR
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Label PR based on changed files
+        uses: actions/labeler@v5
+        with:
+          repo-token: "${{ secrets.GITHUB_TOKEN }}"