## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix. Complete App configurations produce the same auth options as
before.
## What is the current behavior?
Without the docs GitHub App private key, two things fail for a
contributor:
- `pnpm run embeddings` aborts before doing any work. The lint warnings
source throws, and every source shares one `Promise.all` in
[`fetchAllSources()`](https://github.com/supabase/supabase/blob/master/apps/docs/scripts/search/sources/index.ts).
- `pnpm --filter docs build` exits 1 in prebuild, so the `npm run build`
pre-flight CONTRIBUTING.md asks for cannot run either:
```
Error: DOCS_GITHUB_APP_PRIVATE_KEY environment variable is required
at octokit (apps/docs/lib/octokit.ts:21:13)
at fetchAiSkills (apps/docs/scripts/federated-content/fetch-federated-content.ts:258:36)
```
Both read public content, so this is a rate-limit guard rather than
access control: App auth landed in #43015 because unauthenticated calls
(60 req/hr per IP) went flaky on shared runners.
## What is the new behavior?
`apps/docs/lib/octokit.auth.ts` adds one rung below the App: a token
from `GH_TOKEN`, then `GITHUB_TOKEN` (the precedence [`gh help
environment`](https://cli.github.com/manual/gh_help_environment)
documents), so `export GH_TOKEN=$(gh auth token)` is enough to build
locally. Still authenticated, so #43015's fix holds, and still an
authenticated Octokit client, so #44274 holds.
A partially configured App is now an error naming the missing vars,
rather than falling through to a token.
Used by the lint warnings loader and `lib/octokit.ts`. The two token
vars are declared in `apps/docs/turbo.jsonc` for
`turbo/no-undeclared-env-vars`.
## Additional context
With only `GH_TOKEN` set, `turbo run build --filter=docs --force` passes
4/4 and search-index source loading completes. `pnpm test` passes (20
files, 164 tests), and `tsc --noEmit` plus `pnpm run lint` match
`origin/master`. For a complete App config the auth options are
identical to before. Happy to post the fuller verification as a comment.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added flexible GitHub authentication for documentation services,
supporting GitHub App credentials or personal access tokens.
- GitHub App authentication is preferred when fully configured, with
token-based fallback when unavailable.
- Added support for both `GH_TOKEN` and `GITHUB_TOKEN`, with clear
precedence rules.
- **Bug Fixes**
- Improved configuration validation with clear errors for missing or
incomplete authentication settings.
- Standardized authentication across GitHub content and lint-warning
retrieval.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
strictNullChecks was off for docs, which lets errors slip through and
leads to incorrect required/optional typing on Zod-inferred types. This
PR enables strictNullChecks and fixes all the existing violations.
Split guide layouts by section, so that nav data fetches can be pushed down to thesection where they're actually used. Limits blast radius of any data fetch problems, and also lets us push down client components in the future, since layouts now have context on the request path and we don't need a high-level usePathname.
* Check all env vars for studio and list them properly in turbo.json.
* Check all env vars for design-system.
* Fix all env vars for www.
* Fix all env vars for docs.
* Add the rest of the env vars from the packages folder.
* Revert the changes in the sign-in pages.
* Remove useless files. Fix a comment.
* Fix the links in extensions page to always point to supabase.com/docs.
* Change the feature flag rewrite in studio to point to supabase.com/.flags endpoint.
* Replace NEXT_PUBLIC_VERCEL_URL with NEXT_PUBLIC_VERCEL_BRANCH_URL because it's more stable on vercel.com. Remove it from apps where it's not needed.
* Add env vars from packages. Move all passthrough env vars to env vars since they're stable (don't change between pushes).
* Revert changes of studio files.
* Minor fixes for the merge commit.
* Replace all uses of SITE_URL with LW_URL (they're the same). SITE_ORIGIN is not constructed from env vars. LW_URL is constructed from SITE_ORIGIN and launch_week string.
* Use SITE_ORIGIN when fetching the ticket-og.
We allow fetching external data in CodeSamples into a MDX environment, so we have to be careful about preventing code execution.
Current checks:
- External data is inserted as a code block (via the AST, not direct string manipulation), so it is escaped.
Added two new layers of checks:
- Allow-list of organizations, currently set to Supabase-only
- Only allow immutable commit references
Add the ability to embed code samples from GitHub into tutorials, so we can have a single source of truth for the source code.
Introduces the <$CodeSample /> syntax, which is a special syntax and not a real React component (see the directives/README.md for why on earth I did it this way -- in this specific case, CodeHike adjusts the MDX syntax tree before it gets compiled, and we need to adjust it ourselves before CodeHike sees it, so we need to get down to the level of manipulating the AST in order to make this work with CodeHike).
Adjusted one of the example tutorials to use this new feature as a test.
Barry Roodt