chore: production deploy

.github/dependabot.yml

@@ -31,6 +31,10 @@ updates:
           - patch
         exclude-patterns:
           - github.com/compose-spec/compose-go/v2
+    ignore:
+      - dependency-name: "github.com/compose-spec/compose-go/v2"
+      - dependency-name: "github.com/docker/cli"
+      - dependency-name: "github.com/docker/docker"
     cooldown:
       default-days: 7
   - package-ecosystem: "npm"

.github/workflows/api-package-sync.yml

@@ -0,0 +1,118 @@
+name: API Package Sync
+
+on:
+  schedule:
+    - cron: "17 * * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  detect:
+    name: Detect OpenAPI changes
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    outputs:
+      has_changes: ${{ steps.compare.outputs.has_changes }}
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Compare upstream OpenAPI spec
+        id: compare
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          remote_spec="$RUNNER_TEMP/openapi.remote.json"
+          remote_normalized="$RUNNER_TEMP/openapi.remote.normalized.json"
+          tracked_normalized="$RUNNER_TEMP/openapi.tracked.normalized.json"
+          normalize_filter="$RUNNER_TEMP/normalize-openapi.jq"
+
+          curl -fsS https://api.supabase.com/api/v1-json -o "$remote_spec"
+
+          cat > "$normalize_filter" <<'JQ'
+          def pointer_path($p): $p | split("/")[1:] | map(gsub("~1"; "/") | gsub("~0"; "~"));
+          reduce ($overrides[0] // [])[] as $op (.;
+            if $op.op == "test" then
+              if getpath(pointer_path($op.path)) == $op.value then
+                .
+              else
+                error("OpenAPI override test failed at \($op.path)")
+              end
+            elif $op.op == "replace" then
+              setpath(pointer_path($op.path); $op.value)
+            else
+              error("Unsupported OpenAPI override op \($op.op)")
+            end
+          )
+          JQ
+
+          jq -S --slurpfile overrides packages/api/scripts/openapi-overrides.json \
+            -f "$normalize_filter" "$remote_spec" > "$remote_normalized"
+          jq -S . packages/api/src/generated/openapi.json > "$tracked_normalized"
+
+          if cmp -s "$remote_normalized" "$tracked_normalized"; then
+            echo "No upstream OpenAPI changes detected."
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "Upstream OpenAPI changes detected."
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+            diff -u "$tracked_normalized" "$remote_normalized" | sed -n '1,160p' || true
+          fi
+
+  sync:
+    name: Sync API package
+    needs: detect
+    if: needs.detect.outputs.has_changes == 'true'
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Regenerate API package
+        run: pnpm generate
+        working-directory: packages/api
+
+      - name: Format API package
+        run: pnpm exec nx run @supabase/api:fmt:fix
+
+      - name: Check for generated changes
+        id: check
+        run: |
+          if git diff --ignore-space-at-eol --exit-code --quiet packages/api/src/generated; then
+            echo "No generated changes detected."
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "Generated changes detected."
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Generate token
+        if: steps.check.outputs.has_changes == 'true'
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.GH_APP_CLIENT_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+          permission-pull-requests: write
+          permission-contents: write
+
+      - name: Create Pull Request
+        if: steps.check.outputs.has_changes == 'true'
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          commit-message: "chore(api): sync Management API OpenAPI spec"
+          title: "chore(api): sync Management API OpenAPI spec"
+          body: |
+            This PR was automatically created to sync the generated `@supabase/api` package with the latest Management API OpenAPI document.
+
+            Changes were detected in the upstream OpenAPI document exposed by `https://api.supabase.com/api/v1-json`.
+          branch: sync/api-package
+          base: develop

.github/workflows/automerge.yml

@@ -23,7 +23,6 @@ jobs:
 
       - name: Generate token
         id: app-token
-        if: ${{ steps.meta.outputs.update-type == null || steps.meta.outputs.update-type == 'version-update:semver-patch' || (!startsWith(steps.meta.outputs.previous-version, '0.') && steps.meta.outputs.update-type == 'version-update:semver-minor') }}
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ vars.GH_APP_CLIENT_ID }}
@@ -33,16 +32,14 @@ jobs:
 
       # Here the PR gets approved.
       - name: Approve a PR
-        if: ${{ steps.meta.outputs.update-type == null || steps.meta.outputs.update-type == 'version-update:semver-patch' || (!startsWith(steps.meta.outputs.previous-version, '0.') && steps.meta.outputs.update-type == 'version-update:semver-minor') }}
         run: gh pr review --approve "${GITHUB_EVENT_PULL_REQUEST_HTML_URL}"
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           GITHUB_EVENT_PULL_REQUEST_HTML_URL: ${{ github.event.pull_request.html_url }}
 
-      # Finally, this sets the PR to allow auto-merging for patch and minor
-      # updates if all checks pass
+      # Finally, this sets the PR to allow auto-merging once all required
+      # checks pass.
       - name: Enable auto-merge for Dependabot PRs
-        if: ${{ steps.meta.outputs.update-type == null || steps.meta.outputs.update-type == 'version-update:semver-patch' || (!startsWith(steps.meta.outputs.previous-version, '0.') && steps.meta.outputs.update-type == 'version-update:semver-minor') }}
         run: gh pr merge --auto --squash "${GITHUB_EVENT_PULL_REQUEST_HTML_URL}"
         env:
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}

.github/workflows/build-cli-artifacts.yml

@@ -39,7 +39,7 @@ jobs:
       POSTHOG_ENDPOINT: ${{ secrets.POSTHOG_ENDPOINT }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ inputs.ref }}
           persist-credentials: false

.github/workflows/cli-go-api-sync.yml

@@ -14,7 +14,7 @@ jobs:
     name: Sync API Types
     runs-on: blacksmith-2vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 

.github/workflows/cli-go-ci.yml

@@ -21,7 +21,7 @@ jobs:
     name: Test
     runs-on: blacksmith-8vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -60,7 +60,7 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -81,7 +81,7 @@ jobs:
     name: Start
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
@@ -107,7 +107,7 @@ jobs:
       'pull_request' && !github.event.pull_request.head.repo.fork) }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
@@ -124,7 +124,7 @@ jobs:
     name: Codegen
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 

.github/workflows/cli-go-codeql.yml

@@ -63,13 +63,13 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -97,7 +97,7 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@7211b7c8077ea37d8641b6271f6a365a22a5fbfa # v4.36.0
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           category: "/language:${{matrix.language}}"
 defaults:

.github/workflows/cli-go-mirror-image.yml

@@ -34,7 +34,7 @@ jobs:
         run: |
           echo "image=${TAG##*/}" >> $GITHUB_OUTPUT
       - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@99214aa6889fcddfa57764031d71add364327e59 # v6.1.3
+        uses: aws-actions/configure-aws-credentials@e7f100cf4c008499ea8adda475de1042d6975c7b # v6.2.0
         with:
           role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
           aws-region: us-east-1
@@ -46,9 +46,15 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: akhilerm/tag-push-action@f35ff2cb99d407368b5c727adbcc14a2ed81d509 # v2.2.0
-        with:
-          src: docker.io/${{ github.event.client_payload.image || inputs.image }}
-          dst: |
-            public.ecr.aws/supabase/${{ steps.strip.outputs.image }}
-            ghcr.io/supabase/${{ steps.strip.outputs.image }}
+      - uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+      - name: Mirror image
+        env:
+          SOURCE_IMAGE: docker.io/${{ github.event.client_payload.image || inputs.image }}
+          ECR_IMAGE: public.ecr.aws/supabase/${{ steps.strip.outputs.image }}
+          GHCR_IMAGE: ghcr.io/supabase/${{ steps.strip.outputs.image }}
+        run: |
+          docker buildx imagetools create \
+            --prefer-index=false \
+            -t "$ECR_IMAGE" \
+            -t "$GHCR_IMAGE" \
+            "$SOURCE_IMAGE"

.github/workflows/cli-go-mirror.yml

@@ -27,7 +27,7 @@ jobs:
       tags: ${{ steps.list.outputs.tags }}
       curr: ${{ steps.curr.outputs.tags }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0

.github/workflows/cli-go-tag-pkg.yml

@@ -18,7 +18,7 @@ jobs:
     name: Create pkg tag
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: develop
           fetch-depth: 0

.github/workflows/deploy.yml

@@ -13,7 +13,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
           persist-credentials: false

.github/workflows/lint-pull-request.yml

@@ -14,7 +14,7 @@ on:
     types:
       - checks_requested
     branches:
-      - main
+      - develop
 
 permissions:
   pull-requests: read
@@ -38,4 +38,4 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - if: github.event_name == 'merge_group'
-        run: echo "Merge queue entry does not have a pull request payload; reporting success for the required lint check."
+        run: echo "Merge queue entry does not have a pull request payload; reporting success for the required lint check."

.github/workflows/publish-preview-cli-packages.yml

@@ -44,7 +44,7 @@ jobs:
       PR_NUMBER: ${{ github.event.pull_request.number }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 

.github/workflows/release-shared.yml

@@ -82,7 +82,7 @@ jobs:
       VERSION: ${{ inputs.version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -198,7 +198,7 @@ jobs:
           permission-workflows: write
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: true
           token: ${{ steps.app-token.outputs.token }}
@@ -350,7 +350,7 @@ jobs:
       VERSION: ${{ inputs.version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -375,6 +375,7 @@ jobs:
 
       - name: Configure git for tap push
         env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           gh auth setup-git
@@ -384,6 +385,7 @@ jobs:
       - name: Update Homebrew formula
         run: pnpm exec bun apps/cli/scripts/update-homebrew.ts --version "${VERSION}" --name "${BREW_NAME}"
         env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
 
   publish-scoop:
@@ -395,7 +397,7 @@ jobs:
       VERSION: ${{ inputs.version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -420,6 +422,7 @@ jobs:
 
       - name: Configure git for bucket push
         env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           gh auth setup-git
@@ -429,6 +432,7 @@ jobs:
       - name: Update Scoop manifest
         run: pnpm exec bun apps/cli/scripts/update-scoop.ts --version "${VERSION}" --name "${SCOOP_NAME}"
         env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
 
   # Post-publish smoke test for the `supabase/setup-cli` GitHub Action against