dima/supabase
1
0 Fork 0
mirror of https://github.com/supabase/supabase.git synced 2026-10-05 09:25:06 +03:00
Code Issues Packages Projects Releases Wiki Activity

chore: cleanup gh actions (#46454)

Browse Source 
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.

YES

## What kind of change does this PR introduce?

Chore, CI hardening


## Additional context

Hardens all GitHub actions to recommendations of
[zizmor](https://docs.zizmor.sh/audits/)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Chores**
* Disabled persistence of checkout credentials across many CI workflows
to reduce credential exposure.
* Upgraded GitHub App token tooling and tightened generated token
permissions for automation.
* Added cooldown/rate-limiting to dependency update automation to reduce
update churn.
* Adjusted workflow-level permissions, required secret inputs for
workflow callers, and refactored some job step logic.

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46454?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Ali Waseem <waseema393@gmail.com>
This commit is contained in:
Etienne StalmansandAli Waseem authored and GitHub committed 2026-05-28 17:31:04 +02:00
1 parent 7e9badc6b8
commit c9cc6cd835
41 files changed
+114 -47
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/dependabot.yml
+2
View File
@@ -4,6 +4,8 @@ updates:
directory: '/'
schedule:
interval: 'weekly'
cooldown:
default-days: 7
ignore:
- dependency-name: '*'
update-types:
.github/workflows/ai-tests.yml
+1
View File
@@ -34,6 +34,7 @@ jobs:
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
sparse-checkout: |
packages
patches
.github/workflows/authorize-vercel-deploys.yml
+1
View File
@@ -25,6 +25,7 @@ jobs:
- name: Check out repo
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
ref: master
# fetch only the root files and scripts folder
sparse-checkout: |
.github/workflows/autofix_linters.yml
+2 -2
View File
@@ -81,9 +81,9 @@ jobs:
steps:
- name: Generate token
id: app-token
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
app-id: ${{ secrets.GH_AUTOFIX_APP_ID }}
client-id: ${{ vars.GH_AUTOFIX_APP_CLIENT_ID }}
private-key: ${{ secrets.GH_AUTOFIX_PRIVATE_KEY }}
permission-contents: write
.github/workflows/avoid-typos.yml
+2
View File
@@ -18,6 +18,8 @@ jobs:
steps:
- name: Check out code.
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
- name: misspell
uses: reviewdog/action-misspell@9daa94af4357dddb6fd3775de806bc0a8e98d3e4 # v1.26.3
with:
.github/workflows/braintrust-evals.yml
+1
View File
@@ -30,6 +30,7 @@ jobs:
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
fetch-depth: 0
persist-credentials: false
# For PR events, checkout the actual branch so Braintrust can report the correct branch name instead of detached HEAD.
# github.head_ref is the PR source branch, github.ref_name is the fallback for push events (e.g., master).
ref: ${{ github.head_ref || github.ref_name }}
.github/workflows/braintrust-preview-scorers-cleanup.yml
+1
View File
@@ -18,6 +18,7 @@ jobs:
- name: Checkout
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
ref: ${{ github.event.pull_request.head.sha }}
- name: Delete preview scorers from staging
.github/workflows/braintrust-preview-scorers-deploy.yml
+6 -2
View File
@@ -24,14 +24,18 @@ jobs:
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
fetch-depth: 0
persist-credentials: false
ref: ${{ github.head_ref || github.ref_name }}
- name: Check for scorer file changes
id: changed
# On labeled events, always push. On synchronize, only push if scorer files changed.
env:
GH_EVENT_ACTION: ${{ github.event.action }}
GH_EVENT_PR_REF: ${{ github.event.pull_request.base.ref }}
run: |
if [[ "${{ github.event.action }}" == "synchronize" ]]; then
changed=$(git diff --name-only origin/${{ github.event.pull_request.base.ref }}...HEAD | grep -E 'evals/scorer' || true)
if [[ "${GH_EVENT_ACTION}" == "synchronize" ]]; then
changed=$(git diff --name-only origin/${GH_EVENT_PR_REF}...HEAD | grep -E 'evals/scorer' || true)
if [ -z "$changed" ]; then
echo "No scorer files changed, skipping push"
echo "skip=true" >> $GITHUB_OUTPUT
.github/workflows/braintrust-scorers-deploy.yml
+2
View File
@@ -24,6 +24,8 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
- name: Install pnpm
uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
.github/workflows/dashboard-pr-reminder.yml
+1
View File
@@ -19,6 +19,7 @@ jobs:
- name: Checkout repository
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
sparse-checkout: |
scripts
patches
.github/workflows/docs-js-libs-update.yml
+6 -2
View File
@@ -24,6 +24,7 @@ jobs:
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
ref: master
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
@@ -59,10 +60,13 @@ jobs:
- name: Generate token
id: app-token
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
app-id: ${{ secrets.GH_AUTOFIX_APP_ID }}
client-id: ${{ vars.GH_AUTOFIX_APP_CLIENT_ID }}
private-key: ${{ secrets.GH_AUTOFIX_PRIVATE_KEY }}
permission-contents: write
permission-pull-requests: write
- name: Create pull request
uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
.github/workflows/docs-last-changed.yml
+1
View File
@@ -26,6 +26,7 @@ jobs:
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
fetch-depth: 0
persist-credentials: false
sparse-checkout: |
apps/docs
patches
.github/workflows/docs-lint-v2-scheduled.yml
+1
View File
@@ -18,6 +18,7 @@ jobs:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
fetch-depth: 0
persist-credentials: true
sparse-checkout: |
supa-mdx-lint.config.toml
supa-mdx-lint
.github/workflows/docs-lint-v2.yml
+1
View File
@@ -31,6 +31,7 @@ jobs:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
fetch-depth: 0
persist-credentials: false
sparse-checkout: |
supa-mdx-lint.config.toml
supa-mdx-lint
.github/workflows/docs-mgmt-api-update.yml
+4 -2
View File
@@ -17,6 +17,7 @@ jobs:
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
ref: master
sparse-checkout: |
apps/docs
@@ -43,10 +44,11 @@ jobs:
- name: Generate token
id: app-token
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
app-id: ${{ secrets.GH_AUTOFIX_APP_ID }}
client-id: ${{ vars.GH_AUTOFIX_APP_CLIENT_ID }}
private-key: ${{ secrets.GH_AUTOFIX_PRIVATE_KEY }}
permission-pull-requests: write
- name: Create pull request
uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
.github/workflows/docs-sync-auto-troubleshooting.yml
+7 -13
View File
@@ -21,7 +21,7 @@ jobs:
with:
persist-credentials: true
- name: Install pnpm
- name: Install pnpm
uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
with:
run_install: false
@@ -35,19 +35,12 @@ jobs:
- name: Install deps
run: pnpm install --frozen-lockfile
- name: Decode the GitHub App Private Key
id: decode
run: |
private_key=$(echo "${{ secrets.DOCS_GITHUB_APP_PRIVATE_KEY }}" | base64 --decode | awk 'BEGIN {ORS="\\n"} {print}' | head -c -2) &> /dev/null
echo "::add-mask::$private_key"
echo "private-key=$private_key" >> "$GITHUB_OUTPUT"
- name: Create GitHub App token for supabase/troubleshooting
id: app-token
uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
app-id: ${{ vars.DOCS_GITHUB_APP_ID }}
private-key: ${{ steps.decode.outputs.private-key }}
client-id: ${{ vars.DOCS_GITHUB_APP_CLIENT_ID }}
private-key: ${{ secrets.DOCS_GITHUB_APP_PRIVATE_KEY_V2 }}
repositories: troubleshooting
permission-contents: read
@@ -61,10 +54,11 @@ jobs:
- name: Generate PR token
id: pr-token
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
app-id: ${{ secrets.GH_AUTOFIX_APP_ID }}
client-id: ${{ vars.GH_AUTOFIX_APP_CLIENT_ID }}
private-key: ${{ secrets.GH_AUTOFIX_PRIVATE_KEY }}
permission-pull-requests: write
- name: Sync supabase/troubleshooting changes back to supabase/supabase
env:
.github/workflows/docs-sync-troubleshooting.yml
+1
View File
@@ -26,6 +26,7 @@ jobs:
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
sparse-checkout: |
apps/docs
patches
.github/workflows/docs-sync.yml
+1
View File
@@ -28,6 +28,7 @@ jobs:
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
sparse-checkout: |
apps/docs
packages
.github/workflows/docs-tests-smoke.yml
+1
View File
@@ -21,6 +21,7 @@ jobs:
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
sparse-checkout: |
apps/docs
packages
.github/workflows/docs-tests.yml
+1
View File
@@ -25,6 +25,7 @@ jobs:
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
sparse-checkout: |
apps/docs
examples
.github/workflows/fix-typos.yml
+3 -2
View File
@@ -18,14 +18,15 @@ jobs:
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
ref: master
- uses: sobolevn/misspell-fixer-action@06ff0b508d4f4c0ba70d15f9a628232c0aade536 # v0.1.0
- name: Generate token
id: app-token
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
app-id: ${{ secrets.GH_AUTOFIX_APP_ID }}
client-id: ${{ vars.GH_AUTOFIX_APP_CLIENT_ID }}
private-key: ${{ secrets.GH_AUTOFIX_PRIVATE_KEY }}
permission-contents: write
permission-pull-requests: write
.github/workflows/mirror.yml
+3
View File
@@ -6,6 +6,9 @@ on:
version:
required: true
type: string
secrets:
PROD_AWS_ROLE:
required: true
workflow_dispatch:
inputs:
version:
.github/workflows/og_images.yml
+2
View File
@@ -22,6 +22,8 @@ jobs:
steps:
- name: Check out repo
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
- name: Setup the Supabase CLI
uses: supabase/setup-cli@b60b5899c73b63a2d2d651b1e90db8d4c9392f51 # v1.6.0
.github/workflows/pg-meta-tests.yml
+1
View File
@@ -26,6 +26,7 @@ jobs:
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
sparse-checkout: |
packages/pg-meta
packages/tsconfig
.github/workflows/prettier.yml
+1
View File
@@ -20,6 +20,7 @@ jobs:
- name: Check out repo
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
sparse-checkout: |
apps
blocks
.github/workflows/publish_image.yml
+14 -8
View File
@@ -75,7 +75,8 @@ jobs:
image_digest: ${{ steps.build.outputs.digest }}
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
- id: meta
uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4.6.0
with:
@@ -122,18 +123,22 @@ jobs:
password: ${{ secrets.DOCKER_PASSWORD }}
- name: Merge multi-arch manifests
env:
IMAGE_VERSION: ${{ needs.settings.outputs.image_version }}
x86_DIGEST: ${{ needs.release_x86.outputs.image_digest }}
ARM_DIGEST: ${{ needs.release_arm.outputs.image_digest }}
run: |
docker buildx imagetools create -t supabase/studio:${{ needs.settings.outputs.image_version }} \
supabase/studio@${{ needs.release_x86.outputs.image_digest }} \
supabase/studio@${{ needs.release_arm.outputs.image_digest }}
docker buildx imagetools create -t supabase/studio:${IMAGE_VERSION} \
supabase/studio@${x86_DIGEST} \
supabase/studio@${ARM_DIGEST}
docker buildx imagetools create -t supabase/studio:latest \
supabase/studio@${{ needs.release_x86.outputs.image_digest }} \
supabase/studio@${{ needs.release_arm.outputs.image_digest }}
supabase/studio@${x86_DIGEST} \
supabase/studio@${ARM_DIGEST}
echo "Published Registry Images" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "| Image | Link |" >> $GITHUB_STEP_SUMMARY
echo "|-------|------|" >> $GITHUB_STEP_SUMMARY
echo "| \`supabase/studio:${{ needs.settings.outputs.image_version }}\` | [View on Docker Hub](https://hub.docker.com/r/supabase/studio/tags?name=${{ needs.settings.outputs.image_version }}) |" >> $GITHUB_STEP_SUMMARY
echo "| \`supabase/studio:${IMAGE_VERSION}\` | [View on Docker Hub](https://hub.docker.com/r/supabase/studio/tags?name=${IMAGE_VERSION}) |" >> $GITHUB_STEP_SUMMARY
echo "| \`supabase/studio:latest\` | [View on Docker Hub](https://hub.docker.com/r/supabase/studio/tags?name=latest) |" >> $GITHUB_STEP_SUMMARY
publish:
@@ -144,4 +149,5 @@ jobs:
uses: ./.github/workflows/mirror.yml
with:
version: ${{ needs.settings.outputs.image_version }}
secrets: inherit
secrets:
PROD_AWS_ROLE: ${{ secrets.PROD_AWS_ROLE }}
.github/workflows/search.yml
+1
View File
@@ -42,6 +42,7 @@ jobs:
- name: Check out repo
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
sparse-checkout: |
apps/docs
apps/www/.env.local.example
.github/workflows/self-host-tests-smoke.yml
+1
View File
@@ -21,6 +21,7 @@ jobs:
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
sparse-checkout: |
docker/
- name: Run docker-compose up
.github/workflows/studio-docker-build.yml
+2
View File
@@ -19,6 +19,8 @@ jobs:
runs-on: blacksmith-4vcpu-ubuntu-2404
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: filter
with:
.github/workflows/studio-e2e-test.yml
+11 -5
View File
@@ -9,10 +9,6 @@ concurrency:
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true
permissions:
contents: write
pull-requests: write
jobs:
test:
name: 'E2E tests'
@@ -26,11 +22,16 @@ jobs:
outputs:
tests_ran: ${{ steps.filter.outputs.studio == 'true' }}
permissions:
contents: write
env:
OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
- uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
id: filter
with:
@@ -128,9 +129,13 @@ jobs:
if: ${{ !cancelled() && needs.test.outputs.tests_ran == 'true' }}
needs: [test]
runs-on: blacksmith-4vcpu-ubuntu-2404
permissions:
contents: write
pull-requests: write
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
- name: Use Node.js
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
with:
@@ -164,6 +169,7 @@ jobs:
merge-results:
name: 'E2E results'
runs-on: ubuntu-latest
permissions: {}
needs: [test]
if: ${{ !cancelled() && needs.test.outputs.tests_ran == 'true' }}
steps:
.github/workflows/studio-lint-ratchet-decrease.yml
+5 -2
View File
@@ -16,6 +16,7 @@ jobs:
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
sparse-checkout: |
.github
apps/studio
@@ -38,10 +39,12 @@ jobs:
- name: Generate token
id: app-token
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
app-id: ${{ secrets.GH_AUTOFIX_APP_ID }}
client-id: ${{ vars.GH_AUTOFIX_APP_CLIENT_ID }}
private-key: ${{ secrets.GH_AUTOFIX_PRIVATE_KEY }}
permission-contents: write
permission-pull-requests: write
- name: Decrease ESLint ratchet baselines and open PR
env:
.github/workflows/studio-lint-ratchet.yml
+1
View File
@@ -22,6 +22,7 @@ jobs:
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
sparse-checkout: |
.github
apps/studio
.github/workflows/studio-unit-tests.yml
+2
View File
@@ -33,6 +33,7 @@ jobs:
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
sparse-checkout: |
apps/studio
packages
@@ -83,6 +84,7 @@ jobs:
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
sparse-checkout: |
apps/studio
patches
.github/workflows/typecheck.yml
+2
View File
@@ -23,6 +23,8 @@ jobs:
steps:
- name: Checkout
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
name: Install pnpm
.github/workflows/ui-patterns-tests.yml
+1
View File
@@ -21,6 +21,7 @@ jobs:
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
sparse-checkout: |
packages
patches
.github/workflows/ui-tests.yml
+2
View File
@@ -31,6 +31,7 @@ jobs:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
if: steps.filter.outputs.relevant == 'true'
with:
persist-credentials: false
sparse-checkout: |
packages
patches
@@ -72,6 +73,7 @@ jobs:
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
sparse-checkout: |
packages/ui
patches
.github/workflows/update-js-libs.yml
+4 -2
View File
@@ -24,6 +24,7 @@ jobs:
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
ref: master
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
@@ -88,10 +89,11 @@ jobs:
- name: Generate token
id: app-token
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
app-id: ${{ secrets.GH_AUTOFIX_APP_ID }}
private-key: ${{ secrets.GH_AUTOFIX_PRIVATE_KEY }}
permission-pull-requests: write
- name: Create pull request
uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
@@ -119,4 +121,4 @@ jobs:
This PR was created automatically.
branch: 'gha/auto-update-js-libs-v${{ github.event.inputs.version }}'
base: 'master'
base: 'master'
.github/workflows/update-ssr.yml
+5 -2
View File
@@ -24,6 +24,7 @@ jobs:
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
ref: master
- uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4.2.0
@@ -51,10 +52,12 @@ jobs:
- name: Generate token
id: app-token
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
with:
app-id: ${{ secrets.GH_AUTOFIX_APP_ID }}
client-id: ${{ vars.GH_AUTOFIX_APP_CLIENT_ID }}
private-key: ${{ secrets.GH_AUTOFIX_PRIVATE_KEY }}
permission-contents: write
permission-pull-requests: write
- name: Create pull request
uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
.github/workflows/validate-pr.yml
+1 -2
View File
@@ -5,8 +5,7 @@ on:
pull_request:
types: [opened, labeled, unlabeled, synchronize, ready_for_review]
permissions:
contents: read
permissions: {}
jobs:
validate-pr:
.github/workflows/www-tests.yml
+1
View File
@@ -26,6 +26,7 @@ jobs:
steps:
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
with:
persist-credentials: false
sparse-checkout: |
apps/www
packages
examples/edge-functions/.github/workflows/deploy.yaml
Vendored
+8 -3
View File
@@ -6,6 +6,9 @@ on:
- main
workflow_dispatch:
permissions:
contents: read
jobs:
deploy:
runs-on: ubuntu-latest
@@ -15,10 +18,12 @@ jobs:
SUPABASE_PROJECT_ID: ${{ secrets.SUPABASE_PROJECT_ID }}
steps:
- uses: actions/checkout@v3
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false
- uses: supabase/setup-cli@v1
- uses: supabase/setup-cli@3c2f5e2ae34c34e428e8e206e2c4d21fa2d20fbf # v2.1.1
with:
version: latest
- run: supabase functions deploy --project-ref $SUPABASE_PROJECT_ID
- run: supabase functions deploy --project-ref $SUPABASE_PROJECT_ID