mirror of
https://github.com/supabase/supabase.git
synced 2026-10-06 01:45:10 +03:00
932b5dc3b85bda3cb83afa8a2da9fb423ce9727b
316
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 dependabot[bot]
|
05d2f38661 |
chore(deps): bump actions/github-script from 7.1.0 to 9.0.0 (#47929)
Bumps [actions/github-script](https://github.com/actions/github-script) from 7.1.0 to 9.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/github-script/releases">actions/github-script's releases</a>.</em></p> <blockquote> <h2>v9.0.0</h2> <p><strong>New features:</strong></p> <ul> <li><strong><code>getOctokit</code> factory function</strong> — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See <a href="https://github.com/actions/github-script#creating-additional-clients-with-getoctokit">Creating additional clients with <code>getOctokit</code></a> for details and examples.</li> <li><strong>Orchestration ID in user-agent</strong> — The <code>ACTIONS_ORCHESTRATION_ID</code> environment variable is automatically appended to the user-agent string for request tracing.</li> </ul> <p><strong>Breaking changes:</strong></p> <ul> <li><strong><code>require('@actions/github')</code> no longer works in scripts.</strong> The upgrade to <code>@actions/github</code> v9 (ESM-only) means <code>require('@actions/github')</code> will fail at runtime. If you previously used patterns like <code>const { getOctokit } = require('@actions/github')</code> to create secondary clients, use the new injected <code>getOctokit</code> function instead — it's available directly in the script context with no imports needed.</li> <li><code>getOctokit</code> is now an injected function parameter. Scripts that declare <code>const getOctokit = ...</code> or <code>let getOctokit = ...</code> will get a <code>SyntaxError</code> because JavaScript does not allow <code>const</code>/<code>let</code> redeclaration of function parameters. Use the injected <code>getOctokit</code> directly, or use <code>var getOctokit = ...</code> if you need to redeclare it.</li> <li>If your script accesses other <code>@actions/github</code> internals beyond the standard <code>github</code>/<code>octokit</code> client, you may need to update those references for v9 compatibility.</li> </ul> <h2>What's Changed</h2> <ul> <li>Add ACTIONS_ORCHESTRATION_ID to user-agent string by <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/github-script/pull/695">actions/github-script#695</a></li> <li>ci: use deployment: false for integration test environments by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/github-script/pull/712">actions/github-script#712</a></li> <li>feat!: add getOctokit to script context, upgrade <code>@actions/github</code> v9, <code>@octokit/core</code> v7, and related packages by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/github-script/pull/700">actions/github-script#700</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/github-script/pull/695">actions/github-script#695</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/github-script/compare/v8.0.0...v9.0.0">https://github.com/actions/github-script/compare/v8.0.0...v9.0.0</a></p> <h2>v8.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update Node.js version support to 24.x by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/github-script/pull/637">actions/github-script#637</a></li> <li>README for updating actions/github-script from v7 to v8 by <a href="https://github.com/sneha-krip"><code>@sneha-krip</code></a> in <a href="https://redirect.github.com/actions/github-script/pull/653">actions/github-script#653</a></li> </ul> <h2>⚠️ Minimum Compatible Runner Version</h2> <p><strong>v2.327.1</strong><br /> <a href="https://github.com/actions/runner/releases/tag/v2.327.1">Release Notes</a></p> <p>Make sure your runner is updated to this version or newer to use this release.</p> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> made their first contribution in <a href="https://redirect.github.com/actions/github-script/pull/637">actions/github-script#637</a></li> <li><a href="https://github.com/sneha-krip"><code>@sneha-krip</code></a> made their first contribution in <a href="https://redirect.github.com/actions/github-script/pull/653">actions/github-script#653</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/github-script/compare/v7.1.0...v8.0.0">https://github.com/actions/github-script/compare/v7.1.0...v8.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/github-script/commit/3a2844b7e9c422d3c10d287c895573f7108da1b3"><code>3a2844b</code></a> Merge pull request <a href="https://redirect.github.com/actions/github-script/issues/700">#700</a> from actions/salmanmkc/expose-getoctokit + prepare re...</li> <li><a href="https://github.com/actions/github-script/commit/ca10bbdd1a7739de09e99a200c7a59f5d73a4079"><code>ca10bbd</code></a> fix: use <code>@octokit/core/</code>types import for v7 compatibility</li> <li><a href="https://github.com/actions/github-script/commit/86e48e20ac85c970ed1f96e718fd068173948b7b"><code>86e48e2</code></a> merge: incorporate main branch changes</li> <li><a href="https://github.com/actions/github-script/commit/c1084728b5b935ec4ddc1e4cee877b01797b3ff9"><code>c108472</code></a> chore: rebuild dist for v9 upgrade and getOctokit factory</li> <li><a href="https://github.com/actions/github-script/commit/afff112e4f8b57c718168af75b89ce00bc8d091d"><code>afff112</code></a> Merge pull request <a href="https://redirect.github.com/actions/github-script/issues/712">#712</a> from actions/salmanmkc/deployment-false + fix user-ag...</li> <li><a href="https://github.com/actions/github-script/commit/ff8117e5b78c415f814f39ad6998f424fee7b817"><code>ff8117e</code></a> ci: fix user-agent test to handle orchestration ID</li> <li><a href="https://github.com/actions/github-script/commit/81c6b7876079abe10ff715951c9fc7b3e1ab389d"><code>81c6b78</code></a> ci: use deployment: false to suppress deployment noise from integration tests</li> <li><a href="https://github.com/actions/github-script/commit/3953caf8858d318f37b6cc53a9f5708859b5a7b7"><code>3953caf</code></a> docs: update README examples from <a href="https://github.com/v8"><code>@v8</code></a> to <a href="https://github.com/v9"><code>@v9</code></a>, add getOctokit docs and v9 brea...</li> <li><a href="https://github.com/actions/github-script/commit/c17d55b90dcdb3d554d0027a6c180a7adc2daf78"><code>c17d55b</code></a> ci: add getOctokit integration test job</li> <li><a href="https://github.com/actions/github-script/commit/a047196d9a02fe92098771cafbb98c2f1814e408"><code>a047196</code></a> test: add getOctokit integration tests via callAsyncFunction</li> <li>Additional commits viewable in <a href="https://github.com/actions/github-script/compare/v7.1.0...3a2844b7e9c422d3c10d287c895573f7108da1b3">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]andCharis
|
7a60819233 |
chore(deps): bump actions/checkout from 4.3.0 to 7.0.0 (#47925)
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.3.0 to 7.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/releases">actions/checkout's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <ul> <li>block checking out fork pr for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> <li>getting ready for checkout v7 release by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2464">actions/checkout#2464</a></li> <li>update error wording by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2467">actions/checkout#2467</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.3...v7.0.0">https://github.com/actions/checkout/compare/v6.0.3...v7.0.0</a></p> <h2>v6.0.3</h2> <h2>What's Changed</h2> <ul> <li>Update changelog by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2357">actions/checkout#2357</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>Update changelog for v6.0.3 by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2446">actions/checkout#2446</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/yaananth"><code>@yaananth</code></a> made their first contribution in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.3">https://github.com/actions/checkout/compare/v6...v6.0.3</a></p> <h2>v6.0.2</h2> <h2>What's Changed</h2> <ul> <li>Add orchestration_id to git user-agent when ACTIONS_ORCHESTRATION_ID is set by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2355">actions/checkout#2355</a></li> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6.0.1...v6.0.2">https://github.com/actions/checkout/compare/v6.0.1...v6.0.2</a></p> <h2>v6.0.1</h2> <h2>What's Changed</h2> <ul> <li>Update all references from v5 and v4 to v6 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2314">actions/checkout#2314</a></li> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> <li>Clarify v6 README by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2328">actions/checkout#2328</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/checkout/compare/v6...v6.0.1">https://github.com/actions/checkout/compare/v6...v6.0.1</a></p> <h2>v6.0.0</h2> <h2>What's Changed</h2> <ul> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>v6-beta by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2298">actions/checkout#2298</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/actions/checkout/blob/main/CHANGELOG.md">actions/checkout's changelog</a>.</em></p> <blockquote> <h1>Changelog</h1> <h2>v7.0.0</h2> <ul> <li>Block checking out fork PR for pull_request_target and workflow_run by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2454">actions/checkout#2454</a></li> <li>Bump actions/publish-immutable-action from 0.0.3 to 0.0.4 in the minor-actions-dependencies group across 1 directory by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2458">actions/checkout#2458</a></li> <li>Bump flatted from 3.3.1 to 3.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2460">actions/checkout#2460</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2461">actions/checkout#2461</a></li> <li>Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2459">actions/checkout#2459</a></li> <li>upgrade module to esm and update dependencies by <a href="https://github.com/aiqiaoy"><code>@aiqiaoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2463">actions/checkout#2463</a></li> <li>Bump the minor-npm-dependencies group across 1 directory with 3 updates by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/actions/checkout/pull/2462">actions/checkout#2462</a></li> </ul> <h2>v6.0.3</h2> <ul> <li>Fix checkout init for SHA-256 repositories by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2439">actions/checkout#2439</a></li> <li>fix: expand merge commit SHA regex and add SHA-256 test cases by <a href="https://github.com/yaananth"><code>@yaananth</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2414">actions/checkout#2414</a></li> </ul> <h2>v6.0.2</h2> <ul> <li>Fix tag handling: preserve annotations and explicit fetch-tags by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2356">actions/checkout#2356</a></li> </ul> <h2>v6.0.1</h2> <ul> <li>Add worktree support for persist-credentials includeIf by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2327">actions/checkout#2327</a></li> </ul> <h2>v6.0.0</h2> <ul> <li>Persist creds to a separate file by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2286">actions/checkout#2286</a></li> <li>Update README to include Node.js 24 support details and requirements by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2248">actions/checkout#2248</a></li> </ul> <h2>v5.0.1</h2> <ul> <li>Port v6 cleanup to v5 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2301">actions/checkout#2301</a></li> </ul> <h2>v5.0.0</h2> <ul> <li>Update actions checkout to use node 24 by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2226">actions/checkout#2226</a></li> </ul> <h2>v4.3.1</h2> <ul> <li>Port v6 cleanup to v4 by <a href="https://github.com/ericsciple"><code>@ericsciple</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2305">actions/checkout#2305</a></li> </ul> <h2>v4.3.0</h2> <ul> <li>docs: update README.md by <a href="https://github.com/motss"><code>@motss</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1971">actions/checkout#1971</a></li> <li>Add internal repos for checking out multiple repositories by <a href="https://github.com/mouismail"><code>@mouismail</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1977">actions/checkout#1977</a></li> <li>Documentation update - add recommended permissions to Readme by <a href="https://github.com/benwells"><code>@benwells</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2043">actions/checkout#2043</a></li> <li>Adjust positioning of user email note and permissions heading by <a href="https://github.com/joshmgross"><code>@joshmgross</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2044">actions/checkout#2044</a></li> <li>Update README.md by <a href="https://github.com/nebuk89"><code>@nebuk89</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2194">actions/checkout#2194</a></li> <li>Update CODEOWNERS for actions by <a href="https://github.com/TingluoHuang"><code>@TingluoHuang</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2224">actions/checkout#2224</a></li> <li>Update package dependencies by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/2236">actions/checkout#2236</a></li> </ul> <h2>v4.2.2</h2> <ul> <li><code>url-helper.ts</code> now leverages well-known environment variables by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1941">actions/checkout#1941</a></li> <li>Expand unit test coverage for <code>isGhes</code> by <a href="https://github.com/jww3"><code>@jww3</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1946">actions/checkout#1946</a></li> </ul> <h2>v4.2.1</h2> <ul> <li>Check out other refs/* by commit if provided, fall back to ref by <a href="https://github.com/orhantoy"><code>@orhantoy</code></a> in <a href="https://redirect.github.com/actions/checkout/pull/1924">actions/checkout#1924</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/checkout/commit/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"><code>9c091bb</code></a> update error wording (<a href="https://redirect.github.com/actions/checkout/issues/2467">#2467</a>)</li> <li><a href="https://github.com/actions/checkout/commit/1044a6dea927916f2c38ba5aeffbc0a847b1221a"><code>1044a6d</code></a> getting ready for checkout v7 release (<a href="https://redirect.github.com/actions/checkout/issues/2464">#2464</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f0282184c7ce73ab54c7e4ab5a617122602e575f"><code>f028218</code></a> Bump the minor-npm-dependencies group across 1 directory with 3 updates (<a href="https://redirect.github.com/actions/checkout/issues/2462">#2462</a>)</li> <li><a href="https://github.com/actions/checkout/commit/d914b262ffc244530a203ab40decab34c3abf34d"><code>d914b26</code></a> upgrade module to esm and update dependencies (<a href="https://redirect.github.com/actions/checkout/issues/2463">#2463</a>)</li> <li><a href="https://github.com/actions/checkout/commit/537c7ef99cef6e5ddb5e7ff5d16d14510503801d"><code>537c7ef</code></a> Bump <code>@actions/core</code> and <code>@actions/tool-cache</code> and Remove uuid (<a href="https://redirect.github.com/actions/checkout/issues/2459">#2459</a>)</li> <li><a href="https://github.com/actions/checkout/commit/130a169078a413d3a5246a393625e8e742f387f6"><code>130a169</code></a> Bump js-yaml from 4.1.0 to 4.2.0 (<a href="https://redirect.github.com/actions/checkout/issues/2461">#2461</a>)</li> <li><a href="https://github.com/actions/checkout/commit/7d09575332117a40b46e5e020664df234cd416f3"><code>7d09575</code></a> Bump flatted from 3.3.1 to 3.4.2 (<a href="https://redirect.github.com/actions/checkout/issues/2460">#2460</a>)</li> <li><a href="https://github.com/actions/checkout/commit/0f9f3aa320cb53abeb534aeb54048075d9697a0e"><code>0f9f3aa</code></a> Bump actions/publish-immutable-action (<a href="https://redirect.github.com/actions/checkout/issues/2458">#2458</a>)</li> <li><a href="https://github.com/actions/checkout/commit/f9e715a95fcd1f9253f77dd28f11e88d2d6460c7"><code>f9e715a</code></a> block checking out fork pr for pull_request_target and workflow_run (<a href="https://redirect.github.com/actions/checkout/issues/2454">#2454</a>)</li> <li><a href="https://github.com/actions/checkout/commit/df4cb1c069e1874edd31b4311f1884172cec0e10"><code>df4cb1c</code></a> Update changelog for v6.0.3 (<a href="https://redirect.github.com/actions/checkout/issues/2446">#2446</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/checkout/compare/08eba0b27e820071cde6df949e0beb9ba4906955...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Charis <26616127+charislam@users.noreply.github.com> |
||
|
dependabot[bot]andCharis
|
3870172108 |
chore(deps): bump akhilerm/tag-push-action from 2.1.0 to 2.3.0 (#47170)
Bumps [akhilerm/tag-push-action](https://github.com/akhilerm/tag-push-action) from 2.1.0 to 2.3.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/akhilerm/tag-push-action/releases">akhilerm/tag-push-action's releases</a>.</em></p> <blockquote> <h2>v2.3.0</h2> <h3>Highlights</h3> <ul> <li>The action now runs on the Node 24 runtime.</li> </ul> <h3>What's Changed</h3> <ul> <li>internal split into <code>src/index.ts</code> / <code>src/main.ts</code> for cleaner testing.</li> <li>Dependency updates: <ul> <li>Bump typescript from 4.8.4 to 4.9.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/363">akhilerm/tag-push-action#363</a></li> <li>Bump actions/checkout from 4 to 6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/375">akhilerm/tag-push-action#375</a></li> <li>Bump prettier from 3.1.0 to 3.8.4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/376">akhilerm/tag-push-action#376</a>, <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/385">akhilerm/tag-push-action#385</a></li> <li>Bump <code>@types/node</code> from 20.10.5 to 25.9.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/377">akhilerm/tag-push-action#377</a></li> <li>Bump csv-parse from 5.3.1 to 6.2.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/378">akhilerm/tag-push-action#378</a></li> <li>Bump <code>@vercel/ncc</code> from 0.34.0 to 0.44.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/379">akhilerm/tag-push-action#379</a>, <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/390">akhilerm/tag-push-action#390</a></li> <li>Bump docker/login-action from 1 to 4 by <a href="https://github.com/akhilerm"><code>@akhilerm</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/380">akhilerm/tag-push-action#380</a></li> <li>Bump ts-jest from 27.1.5 to 29.4.11 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/382">akhilerm/tag-push-action#382</a></li> <li>Bump eslint-plugin-prettier from 5.1.2 to 5.5.6 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/383">akhilerm/tag-push-action#383</a></li> <li>Bump js-yaml from 4.1.0 to 4.2.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/384">akhilerm/tag-push-action#384</a></li> <li>Bump eslint-plugin-github from 4.4.1 to 6.0.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/386">akhilerm/tag-push-action#386</a></li> <li>Bump jest-circus from 29.7.0 to 30.4.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/389">akhilerm/tag-push-action#389</a></li> <li>Bump eslint-plugin-jest from 27.9.0 to 29.15.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/391">akhilerm/tag-push-action#391</a></li> <li>Bump jest and <code>@types/jest</code> by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/392">akhilerm/tag-push-action#392</a></li> </ul> </li> </ul> <h3>CI / testing</h3> <ul> <li>Added a self-contained copy test against a local authenticated registry.</li> <li>Moved the live docker.io <> quay.io copy test to a daily scheduled run</li> </ul> <p><strong>Full changelog</strong>: <a href="https://github.com/akhilerm/tag-push-action/compare/v2.2.0...v2.3.0">https://github.com/akhilerm/tag-push-action/compare/v2.2.0...v2.3.0</a></p> <h2>v2.2.0</h2> <h2>Highlights</h2> <ul> <li>update to nodejs 20</li> </ul> <h2>What's Changed</h2> <ul> <li>Bump prettier from 2.4.1 to 3.1.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/343">akhilerm/tag-push-action#343</a></li> <li>Bump jest-circus from 27.5.1 to 29.7.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/320">akhilerm/tag-push-action#320</a></li> <li>Bump eslint-plugin-jest from 27.1.4 to 27.6.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/340">akhilerm/tag-push-action#340</a></li> <li>Bump json5 from 1.0.1 to 1.0.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/296">akhilerm/tag-push-action#296</a></li> <li>Bump <code>@actions/core</code> from 1.10.0 to 1.10.1 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/345">akhilerm/tag-push-action#345</a></li> <li>Bump <code>@typescript-eslint/parser</code> from 5.42.1 to 5.62.0 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/347">akhilerm/tag-push-action#347</a></li> <li>Bump eslint-plugin-prettier from 4.2.1 to 5.1.2 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/358">akhilerm/tag-push-action#358</a></li> <li>Bump <code>@types/node</code> from 16.18.3 to 20.10.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a> in <a href="https://redirect.github.com/akhilerm/tag-push-action/pull/355">akhilerm/tag-push-action#355</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/akhilerm/tag-push-action/compare/v2.1.0...v2.2.0">https://github.com/akhilerm/tag-push-action/compare/v2.1.0...v2.2.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/akhilerm/tag-push-action/commit/eadeefebd39db8a47e146115649adae1fce576a6"><code>eadeefe</code></a> Merge pull request <a href="https://redirect.github.com/akhilerm/tag-push-action/issues/389">#389</a> from akhilerm/dependabot/npm_and_yarn/jest-circus-30.4.2</li> <li><a href="https://github.com/akhilerm/tag-push-action/commit/8962cb7144ecbebc290b74473bf46cd306a7c3e6"><code>8962cb7</code></a> Bump jest-circus from 29.7.0 to 30.4.2</li> <li><a href="https://github.com/akhilerm/tag-push-action/commit/28c3d7f674c6db27447b68e235def041eb57d98f"><code>28c3d7f</code></a> Merge pull request <a href="https://redirect.github.com/akhilerm/tag-push-action/issues/390">#390</a> from akhilerm/dependabot/npm_and_yarn/vercel/ncc-0.44.0</li> <li><a href="https://github.com/akhilerm/tag-push-action/commit/0ecaec2cfa9c7db7258779fd5689f2aaca86e883"><code>0ecaec2</code></a> Merge pull request <a href="https://redirect.github.com/akhilerm/tag-push-action/issues/391">#391</a> from akhilerm/dependabot/npm_and_yarn/eslint-plugin-j...</li> <li><a href="https://github.com/akhilerm/tag-push-action/commit/c248b0c1347994c44123a0dd79038b7aff8e2ff4"><code>c248b0c</code></a> Merge pull request <a href="https://redirect.github.com/akhilerm/tag-push-action/issues/392">#392</a> from akhilerm/dependabot/npm_and_yarn/multi-cbfe5253e3</li> <li><a href="https://github.com/akhilerm/tag-push-action/commit/d702ee054d313a39442246aed022e4adb489b2ec"><code>d702ee0</code></a> Merge pull request <a href="https://redirect.github.com/akhilerm/tag-push-action/issues/393">#393</a> from akhilerm/fix-verify-multiarch-digest</li> <li><a href="https://github.com/akhilerm/tag-push-action/commit/efcee5718416156e4ea7f854462c3ef28586c657"><code>efcee57</code></a> Verify registry digests instead of local image IDs</li> <li><a href="https://github.com/akhilerm/tag-push-action/commit/a5909e03cedeca22f40bb94923903a064d0cf3a7"><code>a5909e0</code></a> Bump jest and <code>@types/jest</code></li> <li><a href="https://github.com/akhilerm/tag-push-action/commit/231bdfa4f4c073bd7232c802ccc27167f99ad87b"><code>231bdfa</code></a> Bump eslint-plugin-jest from 27.9.0 to 29.15.2</li> <li><a href="https://github.com/akhilerm/tag-push-action/commit/d15340e5e7ed46fa81242241a38bd6a0bbc463cd"><code>d15340e</code></a> Bump <code>@vercel/ncc</code> from 0.38.4 to 0.44.0</li> <li>Additional commits viewable in <a href="https://github.com/akhilerm/tag-push-action/compare/85bf542f43f5f2060ef76262a67ee3607cb6db37...eadeefebd39db8a47e146115649adae1fce576a6">compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Charis <26616127+charislam@users.noreply.github.com> |
||
|
Joshen Lim
|
06aafe4e0a |
Skip fetchAgentSkills for www typecheck GHA (#47907)
### Context Our TS check GHA occasionally runs into GH rate limits because of `fetchAgentSkills` ### Changes involved - Opting to omit `fetchAgentSkills` for typecheck - `generateStaticContent` is needed still afaict - Allow GITHUB_TOKEN to be passed for `generateStaticContent` - And pass that env var from `typecheck.yml` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Summary by CodeRabbit - **Improvements** - Enhanced reliability of GitHub-powered content during site builds. - GitHub API requests now use secure authentication when a token is available, improving consistency and reducing rate-limit risk. - Repository star and agent-skill loading continues to work gracefully without token access. - **Chores** - Streamlined the type-check workflow to use a leaner content build before running TypeScript checks. - Passed the GitHub token through relevant CI task environments to enable authenticated requests. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
da724eb8c6 |
ci: add zizmor lint and harden GitHub Actions workflows (#47895)
## Summary - Add a zizmor config and CI job that lints `.github/workflows` on every PR touching it, downloading and attestation-verifying the pinned v1.26.1 release binary (cached across runs) - Fix the mutable-tag and excess-permission findings zizmor surfaces in `braintrust-evals.yml`, `publish_image.yml`, and `self-host-tests-smoke.yml`: pin `actions/checkout`/`actions/setup-node` to commit SHAs, and scope `pull-requests`/`packages`/`id-token` permissions down to the specific jobs that need them ## Test plan - [x] Confirm the `zizmor` job runs and passes on this PR <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added automated security scanning for workflow changes on pull requests. * Added configuration to allow specific workflow trigger exceptions. * **Security** * Tightened GitHub Actions permissions at the workflow level and re-granted only where required per job. * Pinned common build action versions to specific commits for more consistent execution. * **Maintenance** * Updated workflow caching and action step annotations without changing linting or fixing behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Ali Waseem
|
4846d9de19 |
fix(ci): don't fail CI when Coveralls upload fails (#47883)
## Summary - Coveralls outages were putting a red X on PRs even when tests passed - Add `fail-on-error: false` and `continue-on-error: true` to the "Upload coverage results to Coveralls" step in `studio-unit-tests.yml` and `ui-tests.yml`, matching `supabase-js` behavior ## Test plan - [ ] Confirm both workflows run successfully on this PR - [ ] Confirm a simulated Coveralls upload failure no longer marks the step/job as failed Fixes FE-3908 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Improved the reliability of automated test workflows by allowing coverage-report uploads to fail without interrupting the overall workflow. * Existing coverage reporting continues when the upload service is available. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
|
55f5676d66 |
ci(studio): run E2E against both Next + TanStack (stack 6/6, from #46424) (#47119)
**Stack 6/6 (final)** of the TanStack Start migration (#46424). The middle slices (#47107 → #47118) have all merged, so this now sits directly on master. ## What's in this PR One file: `.github/workflows/studio-e2e-test.yml` — adds `framework: [next, tanstack]` to the test/report matrices and sets `STUDIO_FRAMEWORK` (consumed by `scripts/dispatch.js`). Until now CI only built/tested Next. This flips on the dual-framework E2E matrix so the TanStack build gets exercised end-to-end on every run. ## ⚠️ Depends on #47657 (merge that first) The `tanstack` shard needs the Monaco loader fix in **#47657** to be on master. Quick version: master's #47182 re-nested the Monaco assets under `public/monaco-editor/vs/` and the TanStack root was still pointing at the old flat path, so Monaco didn't mount anywhere in the TanStack build and every editor-backed test timed out (RLS, cron SQL, realtime JSON, db functions, GraphiQL). Kept that fix on its own branch rather than piling it onto this one. Merge order: 1. #47657 → master 2. re-merge master into here (I'll cascade it) 3. `tanstack` shard goes green → merge this ## ⚠️ Branch-protection note This renames the E2E jobs (`E2E tests` → `E2E tests (next|tanstack, shard)`), so master's current required status checks (`E2E tests (1, 2)` / `(2, 2)`) stop being reported. The required-check list in branch protection needs updating to the new names when this merges. ## Verification Config-only, no app code. The real validation is this matrix running both shards green once #47657 lands — the `next` shards already pass here; the `tanstack` shards pass once the Monaco fix is on master. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Integration overview markdown can now be loaded more reliably from a synchronized on-disk registry (raw markdown support). * **Bug Fixes** * Navigation, redirects, and prefetch now preserve query strings and hash fragments more consistently using Next-like semantics (including repeated keys, empty clearing, and lossless encoding like newlines). * Improved internal-link/router compatibility for Next-style `?`/`#` targets and base-path handling. * Edge Functions diff tab matching works correctly in the browser without Node-specific path utilities. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com> |
||
|
Pedro RodriguesandClaude Opus 4.8
|
c4c213ce3d |
feat(studio): switch dashboard assistant to remote MCP server (#47479)
## I have read the [CONTRIBUTING.md](<https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md>) file. YES ## What kind of change does this PR introduce? Feature / refactor. ## What is the current behavior? The dashboard assistant runs `@supabase/mcp-server-supabase` in-process over an in-memory transport (`lib/ai/supabase-mcp.ts`). ## What is the new behavior? The assistant connects to the **remote MCP server** over HTTP (`@ai-sdk/mcp`), forwarding the dashboard session token as a bearer. URL comes from `NEXT_PUBLIC_MCP_URL` with a local-dev fallback; platform-only, and Nimbus works via the same env var. * **Tool model unchanged:** UI-controlled `execute_sql` (with `needsApproval`) and `deploy_edge_function` still come from Studio; the allowlist (`TOOL_CATEGORY_MAP`) remains the gate keeping the remote's write tools away from the assistant (`read_only` is defense-in-depth). * **Attribution:** sends `x-source-name: supabase-studio` (+ `x-source-version`) → logged as `source_name`/`client_name`. * **Connection lifecycle:** the HTTP client is closed via the request's `AbortSignal` (tools execute later during streaming); `signal` is required on `getTools`/`getMcpTools`. * **Resilience:** a remote-MCP failure degrades to the remaining tools instead of failing the assistant. * **Drift protection:** relied-upon tools are typed against `keyof typeof supabaseMcpToolSchemas`, so a package bump that renames/removes one fails `pnpm typecheck`; a runtime check also warns if the deployed server returns fewer tools. * Adds unit tests for the above. ## Additional context * Verified end-to-end against a local remote MCP server with a dashboard token: `initialize` 200, tools listed, a tool executed, client closed cleanly. * The remote MCP (mgmt-api) already accepts dashboard session tokens (GoTrue-JWT auth path) — no backend change needed. `NEXT_PUBLIC_MCP_URL` must point at each env's `/mcp`. * `@supabase/mcp-server-supabase` is kept — still used by the self-hosted `/api/mcp` routes. Closes [AI-137](https://linear.app/supabase/issue/AI-137/switch-dashboard-assistant-to-remote-mcp) ## Rollout * **Rollout:** merges with `USE_REMOTE_MCP` off (in-process); flip it to `true` per environment (staging → prod → Nimbus) once each one's prerequisites land. * **Rollback:** unset `USE_REMOTE_MCP` and redeploy to fall back to the in-process client — no revert needed. ## Summary by CodeRabbit * **Bug Fixes** * Improved AI request handling so tool loading and generation clean up properly when a request is cancelled or the browser connection closes. * Added safer fallback behavior when remote tool loading fails, so AI features can continue with available tools instead of stopping entirely. * Updated remote tool access to use the current project reference and preserve the correct access headers. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * AI tools now connect more reliably to remote services and stop cleanly when requests end or are canceled. * Tool loading is more resilient, continuing with available tools if remote access is unavailable. * **Bug Fixes** * Improved cleanup to prevent lingering connections during SQL generation and policy workflows. * Added safer handling for remote tool changes and invalid responses. * **Tests** * Expanded automated coverage for remote tool setup, cancellation, and fallback behavior. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Gildas Garcia
|
b724ea706a |
chore: make local e2e testing similar to CI (#47573)
## Problem Because some tests were taking too much time before with the studio supabase default instance, we used to do a reset of its config on CI. This makes local testing more cumbersome as you have to manually reset it without forgetting to create a `functions` directory. ## Solution - prepare the existing e2e supabase config in `e2e/studio` to ensure functions work (create the directory) - use the `workdir` option of the supabase CLI so that it uses the `e2e/studio` specific config - remove the now unnecessary reset done on CI <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved the reliability of the end-to-end setup flow by simplifying cleanup steps and avoiding an extra reset during shutdown. * **Chores** * Updated workflow and script behavior to better support automated test runs without changing the user experience. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Lukas KlingsboandJeremias Menichelli
|
833d3cb1d7 |
docs: migrate Dart/Flutter reference to the new reference pipeline (#47224)
## What Routes the **Dart/Flutter v2** reference through the new reference-content pipeline (`scripts/build-reference-content.ts` + `spec/reference/dart/v2/`), the same one JavaScript v2 already uses. Dart v1 stays on the legacy YAML pipeline. ## How Dart has no upstream TypeDoc dump, so this follows the reference README's "adapt other formats as a pre-step" approach: - **`scripts/generate-dart-reference.ts`** converts the committed legacy spec (`spec/supabase_dart_v2.yml`) plus the shared section tree into a TypeDoc-shaped dump at `spec/reference/dart/v2/supabase_flutter.json` (gitignored, like every other dump). Each Dart method becomes a `variant: 'declaration'` node tagged with `@category`/`@subcategory` and carries the legacy function shape (description, notes, params, examples) on a non-TypeDoc `content` field. - **`build-reference-content.ts`** gains a small, backward-compatible addition: it spreads a declaration's `content` straight onto the `functions.json` entry. The renderer then shows params/examples/notes exactly as the legacy YAML did, with no typeSpec round-trip. The field is absent for real TypeDoc dumps, so **JavaScript output is unchanged** (existing JS snapshot still passes). - `dart-v2` added to `SUPPORTS_NEW_REFERENCE_PROCESS`; the v2 `specFile` is dropped from the nav entry so the legacy generator skips it. - Dart search ingest switched to the new-pipeline loader. - `config.json` + hand-authored partials (intro markdown, `initializing`, and subcategory overviews like `using-filters`, `auth-mfa`) added under `spec/reference/dart/v2/partials/`, mirroring the JS lib. - The dart dump is regenerated in `codegen:references:new` and in CI; a self-contained `dart/v2` snapshot test covers the full YAML → dump → content path. ## Verification - `vitest run scripts/build-reference-content.test.ts` — both JS and Dart snapshots pass. - 112 function sections all resolve to renderable `functions.json` entries (104 methods + 7 subcategory overviews + `initializing`). - `tsc --noEmit` clean for all changed files. - Legacy generator confirmed to skip dart v2 (only `dart.v1.*` regenerated). > Note: the live dev server (which needs the Supabase backend) was not run; verification was done at the data-pipeline level plus parity with the production JS pipeline behavior. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added Dart v2 reference documentation sections, including Installing, Initializing, Filters, Modifiers, Auth Admin, MFA, Passkeys, File Buckets, Introduction, and Upgrade guidance. * Expanded the Dart v2 reference pipeline so Dart API pages are generated from the newer reference content flow. * **Bug Fixes** * Improved Dart reference rendering by preserving legacy descriptions, notes, params, and examples in generated function entries. * Updated Dart v2 reference search to use the new pipeline’s generated content so results and navigation stay in sync. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Jeremias Menichelli <jmenichelli@gmail.com> |
||
|
Gildas Garcia
|
c41e2835e3 |
chore: UI theme cleanup (#47519)
## Problem - We still use/maintain the legacy theming even though we moved to Shadcn - We have two themes list with similar code ## Solution - Migrate some components to `cva` and `cn` instead of `styleHandler` - Remove redundant `themes` in favor of `singleThemes` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Standardized theme selection across the app so theme menus consistently offer the same light/dark/system options, including dropdowns, navigation menus, and command menus. * **Refactor** * Refreshed styling for multiple shared UI components (menus, tabs, side panels, loading indicators, icons, and modal dialogs) to improve consistency while preserving visual behavior. * **Chores** * Improved the UI patterns CI “validate exports” check for clearer failure output when exports change unexpectedly. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Jeremias Menichelli
|
2d8d2aa7db | fix: Refine and simplify markdown pipeline (#47416) | ||
|
Gildas GarciaandIvan Vasilov
|
9c49500ce1 |
chore: add CI job to validate ui-patterns exports (#47408)
## Problem `ui-patterns` exports its components under a subpath (see its `package.json`). This is easy to forget when adding a new component. ## Solution Add a CI job that validate the exports are corrects <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Added a new “Validate exports” step to the UI patterns pipeline to ensure generated exports remain in sync. * When discrepancies are detected, the workflow outputs the diff and fails immediately to prevent stale artifacts. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com> |
||
|
Pamela ChiaandAlaister Young
|
20290c71bd |
fix(docs): stop named-bot markdown 404s on guides (#47337)
## Summary Since the guides UA-redirect shipped (GROWTH-811), named LLM bots requesting `/docs/guides/*` get rewritten to the markdown handler, which returns a 404 when no `.md` file exists. About 90K of those 404s per day land on real pages that serve HTML 200 fine: the bot gets nothing on a page that works. The root cause is that the docs middleware hardcoded `hasMarkdownVariant: true` for every guide path, so it never checked whether a `.md` actually existed. I fixed it in two layers: 1. A build-time slug manifest makes `hasMarkdownVariant` truthful. Guide pages with no `.md` now fall through to HTML 200 instead of a 404. This is content-source-agnostic and future-proof: a new content source can never silently regress to a 404. 2. A second generator pass emits real markdown for the troubleshooting collection (the largest source, ~70% of the 404 volume), so those bots get clean markdown rather than just HTML. ## Changes - Add a shared `markdown-sources` module: a single source of truth for which slugs get a `.md` (guides + troubleshooting), so the generator output and the manifest cannot drift. - Generate markdown for the troubleshooting collection (196 pages, TOML frontmatter parsed via `smol-toml`), written under `public/markdown/guides/troubleshooting/`. - Emit a build-time slug manifest (a gitignored generated `.ts` module, regenerated in `prebuild`, `predev`, and `pretypecheck`, mirroring the existing `__generated__/graphql.ts` lifecycle). - Gate the middleware's `hasMarkdownVariant` on the manifest: serve HTML 200 instead of a 404 for guide paths with no markdown variant. This PR intentionally does not generate markdown for the ai-prompts, YAML config, and externally-fetched (splinter) sources. The HTML fallback covers them now; generating their markdown is follow-up work. ## Testing Local verification (deterministic, against the real manifest and the real negotiation function): - Manifest invariant holds: 744 manifest slugs equal 744 generated `.md` files. - Generator emits 196 troubleshooting files with zero warnings, frontmatter stripped, no leaked delimiters. - Negotiation decision matrix, 6/6: covered slug + bot UA to markdown; uncovered real page + bot UA to pass (HTML 200); nonexistent + bot UA to pass; browser to HTML; covered + `.md` suffix to markdown; uncovered + `.md` suffix to pass. Verified on the Vercel preview deploy: - [x] `User-Agent: ChatGPT-User` on a troubleshooting page returns `200 text/markdown` (real markdown body, frontmatter stripped). - [x] `User-Agent: ChatGPT-User` on an uncovered real page (`ai-tools/ai-prompts/code-format-sql`) returns `200 text/html` (was 404). - [x] Browser request to the same uncovered page returns `200 text/html` (unchanged for humans). - [x] `User-Agent: ChatGPT-User` on a covered standard guide returns `200 text/markdown` (no regression). - [x] `User-Agent: ChatGPT-User` on a nonexistent guide URL returns `404` (correct). Known limitation: an explicit `.md`-suffix request on an uncovered page still 404s by design (an explicit markdown request for a page that has no markdown). The ~90K/day volume is plain-URL UA-based, so it is unaffected. Post-deploy, I will re-run the request-grain 404 reclassification in the GROWTH-915 BQ workspace to confirm fixable guide markdown 404s drop to near zero. ## Linear - fixes GROWTH-946 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added generated markdown slug tracking for docs guides, improving markdown availability detection. * Added automated manifest generation and validation during docs build and CI workflows. * **Bug Fixes** * Improved guide markdown negotiation so only supported guide slugs are treated as having a markdown variant. * Standardized markdown source handling for guides and troubleshooting pages. * **Tests** * Added coverage for guide and troubleshooting slug generation. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Alaister Young <10985857+alaister@users.noreply.github.com> |
||
|
Ali Waseem
|
333097caa8 |
fix(ci): skip AWS ECR auth on fork PRs in studio e2e workflow (#47234)
## Problem
The Selfhosted Studio E2E Tests workflow fails on community (fork) PRs
at the **configure aws credentials** step with:
> Credentials could not be loaded, please check your action inputs:
Could not load credentials from any providers
GitHub does not pass repository secrets to workflows triggered by
`pull_request` from a fork (a deliberate security measure). So on fork
PRs:
- `${{ secrets.PROD_AWS_ROLE }}` evaluates to an empty string, and
- the OIDC `id-token` token isn't available either,
so `aws-actions/configure-aws-credentials` falls through its entire
provider chain and errors out, failing the job.
## Fix
Guard the AWS credential + ECR login steps with
`!github.event.pull_request.head.repo.fork`, the same pattern already
used by the Playwright comment step in this workflow. These steps only
exist to authenticate with AWS ECR to avoid Docker pull rate limiting,
so on fork PRs we simply skip them and pull from `public.ecr.aws`
anonymously, letting the e2e tests run instead of erroring out.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved CI/CD pipeline security configuration to better safeguard
authentication credentials during external contributions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
|
||
|
Gildas Garcia
|
2591a07a4f |
chore: Login to Docker Hub in e2e CI workflow to avoid rate limiting (#47091)
## Problem As the e2e workflow starts the Supabase CLI, it downloads all our images from the AWS ECR for every run. This makes many anonymous pulls that are rate limited. ## Solution Authenticate on AWS ECR <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit ## Chores * Updated the Studio E2E test workflow to include AWS ECR authentication. The workflow now uses tightened job permissions and conditionally authenticates with AWS and Docker registries to reliably pull required container images while improving security. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Johan Bergström
|
fcf81c7d42 |
ci: restore contents write for mgmt api docs token
The implicit `contents: write` it previously inherited from the App installation. This led to the weekly mgmt api docs job failing with a 403 once the upstream spec changed. Add `permission-contents: write` so the token can push the branch again. PR: https://github.com/supabase/supabase/pull/46954 Closes: https://linear.app/supabase/review/ci-restore-contents-write-for-mgmt-api-docs-token-bb8134ed1ecf Refs: https://github.com/supabase/supabase/pull/46454 Refs: https://github.com/supabase/supabase/actions/workflows/docs-mgmt-api-update.yml |
||
|
Gildas Garcia
|
9fc8109067 |
chore: update CI e2e tests diagnostics (#46607)
## Problem We often get errors while starting the local supabase instance on CI. We added diagnostics but they are targeting the wrong port. ## Solution Fix the diagnostics logs <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Granted additional CI credentials and added cloud role assumption plus container registry login before running self‑hosted end-to-end tests. * Improved workflow diagnostics to check an alternate local database port (54322) and show clearer messages when the service is not listening. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Katerina Skroumpelou
|
4af431da00 |
fix(docs): surface SDK diffs in js-libs-update workflow PRs (#46742)
Two-part fix for the Update JS Client Libraries Docs workflow. First, the `make` invocation was narrowed to `make download.tsdoc.v2` so the workflow no longer re-downloads unrelated Management and Storage REST openapi specs alongside the JS TypeDoc files, which was the source of the noise in #46738. Second, the `build-reference-content` snapshot test now serializes to a JSON file via `toMatchFileSnapshot` with a cycle-breaker, because the previous `toMatchSnapshot` of a raw object was being collapsed to `[Object]` placeholders by pretty-format (533 of them), hiding every param rename, JSDoc edit, return-type change, and signature tweak. Verified against supabase-js v2.108.0: the `count` to `rows` rename in `PostgrestTransformBuilder.{limit,maxAffected}` now shows up in the snapshot diff as expected. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated documentation generation workflow to run a more targeted build command. * Added ignore rule for test snapshot files and refreshed the autogenerated PR description/reference snapshot. * **Tests** * Improved test snapshot strategy to use file-based snapshots and robust handling of circular structures for more reliable assertions. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Katerina Skroumpelou
|
4b2e9a206c |
fix(docs): scope js-libs-update vitest run and make tests self-contained (#46737)
The `Update JS Client Libraries Docs` workflow's "Refresh
reference-content snapshot" step fails because `npx vitest run --update
scripts/build-reference-content.test.ts` is treated as a filter, not a
restriction, under Vitest 4, so all docs tests
run. `CodeSample.test.ts` then fails with ENOENT on
`apps/docs/examples/_internal/fixtures/*` because the workflow bypasses
the `pretest` npm hook that runs `codegen:examples`.
This is a regression of #44943 (commit
|
||
|
Andrey A.
|
f5c49e89c5 | chore(self-hosted): expand smoke tests (#46722) | ||
|
|
f20cd22dc3 |
docs: improve SDK automation build step on docs (#46163)
# Second try of making a new better process for SDK automation Instead of building a new pipeline. We will take the lessons learned form round 1, plus the good design and improvement on DX quality for drop-in file as a single step required from SDK team and produce almost identical set of files as used right now to render using the current pipeline. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * New reference-content pipeline producing per-library reference artifacts and integrating into prebuilds, search ingestion, and rendering (type-aware examples). * **Documentation** * Added comprehensive JavaScript SDK v2 reference content and partials (Auth MFA, passkeys, admin, TypeScript support, filters, modifiers, Installing, Initializing, Buckets, etc.). * **Tests & CI** * Added regression snapshot test and updated workflows to refresh reference snapshots and ensure spec downloads. * **Chores** * Updated ignore rules, build scripts, Makefile targets, and package lifecycle hooks. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Katerina Skroumpelou <mandarini@users.noreply.github.com> Co-authored-by: Katerina Skroumpelou <sk.katherine@gmail.com> |
||
|
Charis
|
6e3ffb2b0d |
fix(ci): authenticate git push in decrease-baselines workflow (#46596)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix (CI workflow). ## What is the current behavior? The weekly `Decrease studio lint ratchet baselines` workflow fails on `git push` with: ``` fatal: could not read Username for 'https://github.com': No such device or address Error: Process completed with exit code 128. ``` `actions/checkout` runs with `persist-credentials: false`, so no auth is stored for git. The job generates a GitHub App token but never wires it into git, so the push has no credentials. ## What is the new behavior? Push to an explicit token URL using the already-available `GH_TOKEN`, matching the pattern in `.github/workflows/autofix_linters.yml`. The force-push to `bot/decrease-eslint-ratchet-baselines` now authenticates correctly. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated GitHub Actions workflow configuration to improve automated process reliability. **Note:** This release contains no user-facing changes. The updates are internal infrastructure improvements. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Etienne Stalmans
|
22388ee557 |
fix: create pr need contents-write (#46579)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Bug fix - CI ## What is the current behavior? action fails: https://github.com/supabase/supabase/actions/runs/26818877603/job/79068294605 |
||
|
Charis
|
f95fc2bf3b |
chore(ci): block merge while api-deploy-required label is present (#46482)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? CI / tooling — GitHub Actions workflow update. ## What is the current behavior? PRs that modify `packages/api-types/types/**` can be merged before the corresponding API has shipped to production, breaking the Studio frontend when it calls endpoints that do not exist yet. The `api-deploy-required` label is enforced only by convention and code review, which is easy to miss. ## What is the new behavior? - `.github/labeler.yml`: auto-applies `api-deploy-required` to any PR that touches `packages/api-types/types/**`. - `.github/workflows/label_prs.yml`: drops the `apps/docs/**/*` path filter so the labeler runs on all PRs, and posts a one-time comment when `api-deploy-required` is newly added (uses the labeler's `new-labels` output so re-pushes do not re-comment). - `.github/workflows/validate-pr.yml`: adds a step that fails the `Validate pull request` check while the `api-deploy-required` label is present, mirroring the existing `do-not-merge` pattern. The author removes the label after confirming the API is live to unblock merge. Reviewer: please confirm `Validate pull request` is configured as a required check on `master` in branch protection — that step is what enforces the block. ## Additional context Resolves FE-3479 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Enhanced pull request automation with improved labeling rules for API-related changes. * Added validation that blocks pull request merging until API deployment is confirmed for changes affecting API types. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46482?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Etienne StalmansandAli Waseem
|
c9cc6cd835 |
chore: cleanup gh actions (#46454)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Chore, CI hardening ## Additional context Hardens all GitHub actions to recommendations of [zizmor](https://docs.zizmor.sh/audits/) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Disabled persistence of checkout credentials across many CI workflows to reduce credential exposure. * Upgraded GitHub App token tooling and tightened generated token permissions for automation. * Added cooldown/rate-limiting to dependency update automation to reduce update churn. * Adjusted workflow-level permissions, required secret inputs for workflow callers, and refactored some job step logic. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46454?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Ali Waseem <waseema393@gmail.com> |
||
|
Charis
|
cc0b2d3d21 |
chore(studio): remove require-safe-sql-fragment ESLint rule (#46079)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Refactor / chore. ## What is the current behavior? A custom type-aware ESLint rule (`studio/require-safe-sql-fragment`) enforces that the `sql` argument to `executeSql` is a `SafeSqlFragment`. It runs in a separate `eslint.type-checks.config.cjs` and a dedicated CI ratchet step, and pulls in `@typescript-eslint/utils` as a direct dev dependency. ## What is the new behavior? `SafeSqlFragment` enforcement is now handled entirely by TypeScript compilation. The ESLint rule, its dedicated config, the ratchet baselines for it, the CI step, and the `@typescript-eslint/utils` direct dev dependency have all been removed. ## Additional context <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Simplified development linting workflow by removing type-aware ESLint checks and associated rule files. * Cleaned up ESLint configuration and dependencies in the studio application. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46079?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Stephen Morgan
|
1e28e6ac01 |
fix: run format step in separate low-privilege job (#46090)
Out of an abundance of caution, running the format step in a strictly read-only context. Added explicit validations on pushes instead of relying on an implicit lack of pull_request_target Resolves PRODSEC-118 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Reworked automated autofix workflow into a two-step format-and-apply flow, reduced top-level permissions, and moved from an auto-commit action to a manual apply/commit/push process for more controlled automated fixes. * No user-facing features or functionality changed. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/supabase/supabase/pull/46090?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
1e59ef9a06 |
chore: balance e2e shards load (#45661)
## Problem We run the e2e tests across two shards to reduce their duration. However, one takes longer than the other. ## Solution Use a currently hidden Playwright feature to balance their load <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Upgraded Playwright test dependency to a newer version for refreshed test tooling and fixes. * Adjusted end-to-end test shard weighting to rebalance distribution across parallel runs. * **Tests** * Stabilized several end-to-end editor interactions to make E2E flows more reliable. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Gildas Garcia
|
f809d1c99a |
chore: fix e2e flaky Supabase CLI start (#45637)
## Problem The Supabase CLI sometimes fails to start because the postgres port is already used: > failed to start docker container: Error response from daemon: failed to set up container networking: driver failed programming external connectivity on endpoint supabase_db_supabase (10587f26e7287c8086fd27db12be7aac4afe1f3fc521c9d7a8dfe109993c995d): failed to bind host port for 0.0.0.0:54322:172.18.0.2:5432/tcp: address already in use ## Solution None yet, debugging <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Enhanced end-to-end test workflow with added pre-start and failure diagnostics for better observability and troubleshooting of test runs. * Updated the e2e setup CLI script to skip certain local services by default and clarify script formatting for maintainability. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Inder Singh
|
d3bce8fc29 | chore(self-hosted): use quiet pull for compose in smoke test (#45216) | ||
|
Katerina Skroumpelou
|
28ef62cf31 |
fix(docs): scope vitest run to target dir in js-libs-update workflow (#44943)
Vitest 4 no longer restricts test execution when a file path is passed as a positional filter, causing all docs tests to run and fail on unrelated tests. Use --dir to scope to the target directory. PR #44833 made the update which broke the behaviour. |
||
|
Katerina Skroumpelou
|
d5c8f2cd3f |
chore: @supabase/ssr version management (#44705)
* Add `@supabase/ssr` to catalog * Use `catalog:` version of `@supabase/ssr` across repo * Add workflow to update `@supabase/ssr` * Switch runners for package and docs updates to `ubuntu-latest` (free, lighter) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Centralized `@supabase/ssr` versioning across the workspace via the package catalog. * Updated CI workflow runners to a more consistent execution environment. * Added an automated workflow to streamline updating the `@supabase/ssr` package and refreshing dependency lockfiles. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Charis
|
bf46092290 |
ci: add safesql ratchet (#44678)
We are currently migrating to the safeSql utility for all SQL arguments of executeSql. During the migration, executeSql will continue to accept plain strings for backwards compatibility. Adding a custom ESLint rule so we can ratchet this and prevent new calls of executeSql with plain strings. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added SQL safety validation throughout the application to enforce secure query construction and prevent SQL-related vulnerabilities * Introduced type-aware linting to identify and catch type-related issues during development and continuous integration processes * **Chores** * Enhanced continuous integration pipeline with improved code quality enforcement <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Andrey A.
|
0950b99bf0 | chore: add a nofile limit for supavisor in smoke test (#44582) | ||
|
Ali Waseem
|
db281bd1d1 |
feat: alert in Slack when master breaks (#44456)
## Summary - Adds a new GitHub Actions workflow that sends a Slack alert when Studio E2E tests or unit tests fail on master - Uses `workflow_run` trigger so no changes needed to existing CI workflows - Reuses the existing `SLACK_DASHBOARD_WEBHOOK_URL` secret Closes FE-2883 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Implemented automated Slack notifications to alert when master branch build failures occur, including build run details, commit information, and commit author. <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Katerina Skroumpelou
|
75e1bbb4a6 |
ci: add release notes on update js libs pr (#44241)
Include release notes in the automated PR that updates supabase-js across the repo. * Looks at what version is installed * It includes all changelogs between installed version and to-be-installed version |
||
|
Etienne Stalmans
|
55852a0eb1 |
chore: pin all actions (#42068)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? chore ## Additional context We will require all actions to be pinned going forward <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated CI/CD workflows to use pinned action versions for improved reliability and consistency. <sub>✏️ Tip: You can customize this high-level summary in your review settings.</sub> <!-- end of auto-generated comment: release notes by coderabbit.ai --> |
||
|
Katerina Skroumpelou
|
23fa582695 |
ci: fix mgmt api docs generator (#44121)
The [`docs-mgmt-api-update` workflow](https://github.com/supabase/supabase/blob/master/.github/workflows/docs-mgmt-api-update.yml#L21) uses `sparse-checkout`, only pulling `apps/docs` and patches. After PR #42987, the Makefile's `redocly` commands were changed to run via `pnpm exec` `redocly` from `packages/generator`, but that directory was never checked out, causing the can't `cd` error. Adding `packages/generator` to `sparse-checkout` makes the existing Makefile dependency explicit in the workflow. |
||
|
Andrey A.
|
c3701936b7 | fix(self-hosted): increase timeouts for supavisor (#43905) | ||
|
Ivan Vasilov
|
d07e78a616 |
chore: Run prettier on examples folder (#43851)
This PR runs `prettier` on the `examples` folder. Depends on https://github.com/supabase/supabase/pull/43849. |
||
|
Ivan VasilovandJoshen Lim
|
9fa96977be |
chore: Minor prettier fixes (#43849)
This PR fixes some prettier issues: - Bump and unify all prettier versions to 3.7.3 across teh whole repo - Bump the SQL prettier plugin - When running `test:prettier`, check `mdx` files also - Run the new prettier format on all files --------- Co-authored-by: Joshen Lim <joshenlimek@gmail.com> |
||
|
Ali Waseem
|
4d967740f7 |
fix permissions for docker image publish (#43823)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? GitHub action permissions have changed, so because of that We need to apply permissions on the parent |
||
|
Gildas Garcia
|
43e793f5ad |
chore: fix e2e flakyness (#43739)
## Problem Since the upgrade to NextJS 16.1.6, many e2e tests run fails with timeout, probably when building or starting the studio ## Solution - [x] Add dedicated steps for supabase setup and NextJS build to ease debugging - [x] Fix flakyness |
||
|
Ali Waseem
|
3172fc47fe |
fix: bump up runner due to resources (#43722)
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Our runners is running out of memory and CPU when running the build. Just trying to bump up the blacksmith runner so they match the build machine in Vercel. |
||
|
Gildas Garcia
|
2773179a5b |
fix: studio docker build fails because of package patches (#43713)
## Problem The docker build for studio fails because pnpm patches are not included ## Solution - bump pnpm version in Dockefile to match the one used by the repo - bump turbo version in Dockerfile to use one that handles pnpm patches - add a script to test the build locally - add a github action to validate the build on each PR |
||
|
Katerina SkroumpelouandIvan Vasilov
|
77e5180c5c |
chore: format files (#43668)
Format files. Run `pnpm format` at root. --------- Co-authored-by: Ivan Vasilov <vasilov.ivan@gmail.com> |
||
|
Etienne Stalmans
|
92bdbb2f57 |
chore: explicit permissions on actions (#43526)
enforces minimal set of permissions, the same as other actions in the repo |
||
|
Matt Rossman
|
517171b246 |
feat(assistant): online evals support and CI workflows (#43194)
Lays groundwork for online evals on Assistant chat logs. https://www.braintrust.dev/docs/observe/score-online ### Changes - New workflows: - `braintrust-scorers-deploy.yml` keeps prod scorers in sync on push to `master` - `braintrust-preview-scorers-deploy.yml` deploys preview scorers to the staging project for PRs labeled `preview-scorers`, posting a comment with scorer links ([example](https://github.com/supabase/supabase/pull/43194#issuecomment-4000097222)) - `braintrust-preview-scorers-cleanup.yml` deletes preview scorers when the PR is closed ([example](https://github.com/supabase/supabase/pull/43194#issuecomment-4000749847)) - Adds `evals/scorer-online.ts` entry point invoked with `pnpm scorers:deploy`, registering scorers for online evals in the Braintrust "Assistant" project - Refactors scorer code to separate online-compatible scorers (`scorer-online.ts`) from WASM-dependent ones (`scorer-wasm.ts`) - "URL Validity" scorer now only checks Supabase domains to prevent requests to untrusted origins - Span `input` is now shaped `{ prompt: string }` instead of plain `string` for compatibility with offline eval scorers - Env vars `BRAINTRUST_STAGING_PROJECT_ID` and `BRAINTRUST_PROJECT_ID` configured in GitHub repo settings - `generateAssistantResponse` now uses `startSpan` + `withCurrent` instead of `traced()` to manually manage the root span lifecycle — this ensures `onFinish` logs output to the span _before_ `span.end()` is called, which is when Braintrust triggers scoring automations ### Online Scorers We share scoring logic across offline and online evals, but some of our scorers aren't transferrable to an "online" setting due to runtime challenges or ground truth requirements. **Supported** - Goal Completion - Conciseness - Completeness - Docs Faithfulness - URL Validity **Unsupported** - Correctness (requires ground truth output) - Tool Usage (requires ground truth requiredTools) - SQL Syntax (uses libpg-query WASM) - SQL Identifier Quoting (uses libpg-query WASM) ### How to use these scorers Going forward if you want to add/edit online eval scorers, add the `preview-scorers` label to a PR. This deploys scorers to the [Assistant (Staging Scorers)](https://www.braintrust.dev/app/supabase.io/p/Assistant%20(Staging%20Scorers)?v=Overview) project in Braintrust with branch-specific slugs, and comments on the PR ([example](https://github.com/supabase/supabase/pull/43194#issuecomment-4000097222)). From the Braintrust dashboard you can "Test" the scorer with traces from any project. <img width="1866" height="528" alt="CleanShot 2026-03-05 at 15 15 00@2x" src="https://github.com/user-attachments/assets/4f15cebc-3f2d-4e8a-9ee2-fe8ef7bf4199" /> Once merged, scorers are deployed to the primary [Assistant](https://www.braintrust.dev/app/supabase.io/p/Assistant) project, and preview scorers are deleted from the staging project. Down the road, scorers on the Assistant project will run automatically on a sample of production traces. Closes AI-437 |
||
|
Gildas Garcia
|
13bfc4502a |
chore: e2e general improvements (#43547)
## Problem e2e tests are still flaky and not as fast as they could be ## Solution - [x] Reset supabase instance: this makes the database visualiser tests faster as there are less tables to screenshot - [x] Improve the single file setup utilities so that they never block local tests by cleaning them up before starting - [x] Disable animations while running the tests (less time waiting for animations to complete - [x] Add utility functions that help reproducing flaky tests locally |
