Connect to a warehouse

The playground runs on local DuckDB and needs no credentials. To run against a real warehouse, you swap one block: the [adapter] definition. Your tables stay in your warehouse. Rocky connects over the warehouse API and sends it SQL.

Name an adapter, then point a pipeline at it

Rocky uses named adapters and named pipelines. An adapter defines one connection. A pipeline is a unit of work declared in rocky.toml, and its target points at that adapter by name:

[adapter.prod]
type = "databricks"   # or "snowflake", "bigquery"
# ...connection fields...

[pipeline.bronze.target]
adapter = "prod"

Connection fields use ${VAR} substitution, so no secret lands in the file. Export the variables in your shell or in CI. You can then commit rocky.toml safely.

Configure the adapter

Databricks is the production target. Rocky reads a Personal Access Token first. If no token is set, it falls back to OAuth M2M with a service principal.

[adapter.prod]
type = "databricks"
host = "${DATABRICKS_HOST}"
http_path = "${DATABRICKS_HTTP_PATH}"
token = "${DATABRICKS_TOKEN}"

export DATABRICKS_HOST="workspace.cloud.databricks.com"
export DATABRICKS_HTTP_PATH="/sql/1.0/warehouses/abc123"
export DATABRICKS_TOKEN="dapi..."

For OAuth M2M instead of a PAT, drop token and set a service principal:

[adapter.prod]
type = "databricks"
host = "${DATABRICKS_HOST}"
http_path = "${DATABRICKS_HTTP_PATH}"
client_id = "${DATABRICKS_CLIENT_ID}"
client_secret = "${DATABRICKS_CLIENT_SECRET}"

Snowflake is Beta. Rocky tries each auth method in this order: Programmatic Access Token, OAuth, key-pair JWT, password. A Programmatic Access Token (Snowsight → User Profile → Personal Access Tokens) is the simplest:

[adapter.prod]
type = "snowflake"
account = "${SNOWFLAKE_ACCOUNT}"
warehouse = "COMPUTE_WH"
pat = "${SNOWFLAKE_PAT}"

For key-pair JWT auth (rotatable, scoped per user), set a username and a PKCS#8 PEM key path instead:

[adapter.prod]
type = "snowflake"
account = "${SNOWFLAKE_ACCOUNT}"
warehouse = "COMPUTE_WH"
username = "${SNOWFLAKE_USER}"
private_key_path = "${SNOWFLAKE_KEY_PATH}"

database and role are optional defaults you can set on the adapter.

BigQuery is Beta. The adapter takes a project and a location. Credentials come from the environment, not from the config file:

[adapter.prod]
type = "bigquery"
project_id = "${GCP_PROJECT_ID}"
location = "EU"

Authenticate with a service-account key or Application Default Credentials:

# Service-account key file
export GOOGLE_APPLICATION_CREDENTIALS="/path/to/service-account.json"

# ...or use ADC from the gcloud CLI
gcloud auth application-default login

DuckDB runs inside the Rocky process and needs no credentials. It backs the playground and rocky test. Use it for local development against a file:

[adapter.local]
type = "duckdb"
path = "warehouse.duckdb"

Run against it

Configure the adapter, export the environment variables, then run these four commands in order. Each one costs more than the one before it, so a failure stops you early:

rocky validate          # config + adapter wiring; no network calls
rocky doctor            # pings the warehouse to verify credentials and connectivity
plan_id=$(rocky plan --output json | jq -r .plan_id)
rocky apply "$plan_id"

rocky doctor tells you which adapter Rocky can reach before you spend any warehouse time. rocky plan compiles the models and writes a plan; rocky apply executes that plan against the warehouse.

For a replication pipeline, scope the run with --filter. For example, rocky plan --filter tenant=acme plans one tenant.

Each adapter has its own reference page for fields, authentication, and examples: DuckDB, Databricks, Snowflake, BigQuery, Fivetran. The fields every adapter type shares are in Configuration. Databricks auth detail is in Authentication.

Next steps

Migrating from dbt: run rocky import-dbt on a dbt project and point the result at this adapter.
CI/CD integration: gate PRs with rocky ci and preview changes before they merge.
Governance: grants, classification, masking, and retention on the warehouse.