chore: production deploy

.bun-version

@@ -1 +1 @@
-1.4.2
+1.4.4

.gitattributes

@@ -14,28 +14,21 @@ apps/cli/src/shared/telemetry/__fixtures__/error-tags.txt text eol=lf
 # statistics and collapses them in pull request diffs -- they are build output to
 # be regenerated, not code to review, and together they outweigh the hand-written
 # source. The attribute is GitHub-only: git, CI, and local diffs are unaffected.
-# Collapsed is not hidden. v1-openapi.yaml and the lockfiles do carry changes
-# worth reading -- an upstream API change, a dependency substitution -- and both
-# stay one click away in review.
-# Regeneration is owned by `go generate` in apps/cli-go and by the `generate`
-# turbo task, whose `outputs` in turbo.json are the source of truth for this list.
-# Only the generated files are listed, not their hand-written inputs
-# (pkg/api/*.cfg.yaml, api/overlay.yaml). apps/docs/content/docs/commands/ is
-# generated too but gitignored, so it needs no entry.
-apps/cli-go/api/v1-openapi.yaml linguist-generated=true
-apps/cli-go/pkg/api/*.gen.go linguist-generated=true
+# Collapsed is not hidden. The lockfile does carry changes worth reading --
+# a dependency substitution -- and stays one click away in review.
+# Regeneration is owned by the `generate` turbo task, whose `outputs` in
+# turbo.json are the source of truth for this list. Only the generated files
+# are listed, not their hand-written inputs. apps/docs/content/docs/commands/
+# is generated too but gitignored, so it needs no entry.
 packages/api/src/generated/* linguist-generated=true
 packages/api/scripts/openapi-source.json linguist-generated=true
 packages/stack/src/functions/generated/* text eol=lf linguist-generated=true
 apps/cli/src/shared/feedback/database.types.ts linguist-generated=true
-apps/docs/public/cli/config.schema.json linguist-generated=true
-apps/docs/public/cli/project-config.schema.json linguist-generated=true
-apps/docs/public/cli/supabase-lock/v1.schema.json linguist-generated=true
+apps/docs/public/schemas/** linguist-generated=true
 
 # Lockfiles. Collapsed rather than hidden -- a dependency change is still one
 # click away in review, which is the same treatment GitHub gives package-lock.json.
 pnpm-lock.yaml linguist-generated=true
-apps/cli-go/go.sum linguist-generated=true
 
 # Not a language marker -- this is the service image manifest, not a container build.
 apps/cli/src/shared/services/Dockerfile linguist-detectable=false

.github/CODEOWNERS

@@ -10,15 +10,8 @@
 /tools/*/package.json @supabase/cli @supabase-oss
 /pnpm-lock.yaml @supabase/cli @supabase-oss
 /pnpm-workspace.yaml @supabase/cli @supabase-oss
-/apps/cli-go/go.mod @supabase/cli @supabase-oss
-/apps/cli-go/go.sum @supabase/cli @supabase-oss
-/apps/cli-go/pkg/go.mod @supabase/cli @supabase-oss
-/apps/cli-go/pkg/go.sum @supabase/cli @supabase-oss
 /apps/cli/src/shared/services/Dockerfile @supabase/cli @supabase-oss
-/apps/cli-go/pkg/config/templates/Dockerfile @supabase/cli @supabase-oss
 /packages/stack/src/Artifacts.ts @supabase/cli @supabase-oss
-/apps/cli-go/api/v1-openapi.yaml @supabase/cli @supabase-oss
-/apps/cli-go/pkg/api/*.gen.go @supabase/cli @supabase-oss
 /packages/api/src/generated/ @supabase/cli @supabase-oss
 /packages/api/scripts/openapi-source.json @supabase/cli @supabase-oss
 

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -107,7 +107,7 @@ body:
     id: ticket-id
     attributes:
       label: Crash report ID
-      description: If the CLI printed one after rerunning with `--create-ticket`, paste the crash report ID.
+      description: If you have a crash report or support ticket ID, paste it here.
       placeholder: ab1ac733e31e4f928a4d7c8402543712
     validations:
       required: false

.github/actions/setup/action.yml

@@ -14,16 +14,10 @@ inputs:
       fails with a path validation error.
     required: false
     default: "true"
-  go-cache:
-    description: >-
-      Whether to restore the Go module and build caches. Disable this in jobs
-      that never run Go.
-    required: false
-    default: "true"
   tools:
     description: >-
       Space-separated mise tools to install instead of every tool in
-      mise.toml. Skipping the Go toolchain keeps the restored mise cache small.
+      mise.toml.
     required: false
     default: ""
   pnpm-store-cache:
@@ -126,11 +120,10 @@ runs:
         commit: ${{ steps.sticky.outputs.commit }}
 
     - name: Install toolchains
-      uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      uses: jdx/mise-action@8418fedb1110381a0d3ba51a7a415d7c1b884550 # v5.2.2
       with:
-        version: 2026.9.0
+        version: 2026.10.17
         install_args: ${{ inputs.tools }}
-        cache_key: ${{ inputs.tools != '' && format('mise-{0}-{1}-{2}-{3}', runner.os, runner.arch, inputs.tools, hashFiles('mise.toml', 'mise.lock', '.node-version', '.bun-version', 'package.json')) || '' }}
 
     - name: Resolve pnpm store path
       if: inputs.dependency-cache == 'true'
@@ -189,41 +182,6 @@ runs:
         path: ${{ steps.pnpm-cache.outputs.path }}/lockfile-verified.jsonl
         key: pnpm-verify-${{ runner.os }}-${{ inputs.dependency-firewall-token != '' && 'firewall' || 'public' }}-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml') }}
 
-    - name: Resolve Go cache paths
-      if: inputs.dependency-cache == 'true' && inputs.go-cache == 'true'
-      id: go-cache
-      shell: bash
-      run: |
-        echo "mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
-        echo "build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
-
-    - name: Mount Go module disk
-      if: inputs.dependency-cache == 'true' && inputs.go-cache == 'true' && steps.sticky.outputs.enabled == 'true'
-      uses: useblacksmith/stickydisk@b6cb58d1d31d6d32a25248fab12493d831f7bd48 # v1.7.2
-      with:
-        key: ${{ github.repository }}-go-mod-v3-${{ runner.arch }}
-        path: ${{ steps.go-cache.outputs.mod }}
-        commit: ${{ steps.sticky.outputs.commit }}
-
-    - name: Mount Go build disk
-      if: inputs.dependency-cache == 'true' && inputs.go-cache == 'true' && steps.sticky.outputs.enabled == 'true'
-      uses: useblacksmith/stickydisk@b6cb58d1d31d6d32a25248fab12493d831f7bd48 # v1.7.2
-      with:
-        key: ${{ github.repository }}-go-build-v3-${{ runner.arch }}
-        path: ${{ steps.go-cache.outputs.build }}
-        commit: ${{ steps.sticky.outputs.commit }}
-
-    - name: Configure Go dependency cache
-      if: inputs.dependency-cache == 'true' && inputs.go-cache == 'true' && steps.sticky.outputs.enabled != 'true'
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: |
-          ${{ steps.go-cache.outputs.mod }}
-          ${{ steps.go-cache.outputs.build }}
-        key: go-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('apps/cli-go/go.mod', 'apps/cli-go/go.sum') }}
-        restore-keys: |
-          go-cache-${{ runner.os }}-${{ runner.arch }}-
-
     - name: Install dependencies
       shell: bash
       env:

.github/dependabot.yml

@@ -37,28 +37,6 @@ updates:
         # — never bundle it into the actions-major group.
     cooldown:
       default-days: 7
-  - package-ecosystem: "gomod"
-    directories:
-      - "/apps/cli-go"
-      - "/apps/cli-go/pkg"
-    schedule:
-      interval: "cron"
-      cronjob: "0 0 * * *"
-    commit-message:
-      prefix: "chore(cli-go): "
-    groups:
-      go-minor:
-        update-types:
-          - minor
-          - patch
-        exclude-patterns:
-          - github.com/compose-spec/compose-go/v2
-    ignore:
-      - dependency-name: "github.com/compose-spec/compose-go/v2"
-      - dependency-name: "github.com/docker/cli"
-      - dependency-name: "github.com/docker/docker"
-    cooldown:
-      default-days: 7
   - package-ecosystem: "npm"
     directory: "/"
     schedule:

.github/jactionlint.yaml

@@ -1,4 +1,7 @@
-require-commit-hash: true # actions, reusable workflows and docker:// must be pinned to a full SHA / @sha256 digest
+rules:
+  missing-timeout: off
+  concurrency-limits: off
+  unpinned-uses: error # actions, reusable workflows and docker:// must be pinned to a full SHA / @sha256 digest
 self-hosted-runner:
   labels:
     - arm-runner
@@ -8,3 +11,8 @@ self-hosted-runner:
     - blacksmith-8vcpu-ubuntu-2404
     - blacksmith-8vcpu-windows-2025
     - blacksmith-32vcpu-ubuntu-2404
+paths:
+  # Other projects' repositories, pulled in as git submodules. CI never checks them out.
+  ".repos/**":
+    ignore:
+      - ".*"

.github/scripts/ai-review/resolve.ts

@@ -12,7 +12,7 @@
  *
  * `resolveDecision` is the pure orchestration function (I/O injected) a test
  * can drive without the network; `main()` wires up the real GitHub I/O,
- * writes `should_run`/`pr_number`/`head_ref`/`trigger` to `$GITHUB_OUTPUT`,
+ * writes `should_run`/`pr_number`/`head_sha`/`trigger` to `$GITHUB_OUTPUT`,
  * and surfaces the skip reason (if any) in `$GITHUB_STEP_SUMMARY`.
  *
  * Run in CI as: `bun .github/scripts/ai-review/resolve.ts`.
@@ -374,7 +374,6 @@ function writeOutputs(result: ResolveResult, prNumber: number): void {
   const entries: Record<string, string> = {
     should_run: String(result.shouldRun),
     pr_number: String(prNumber),
-    head_ref: `refs/pull/${prNumber}/head`,
     head_sha: result.headSha ?? "",
     trigger: result.trigger,
   };

.github/scripts/cli-bench/github.ts

@@ -0,0 +1,69 @@
+/** Small GitHub REST helpers shared by the CLI benchmark scripts. */
+
+export function requireEnv(name: string): string {
+  const value = process.env[name];
+  if (!value) throw new Error(`Missing required environment variable: ${name}`);
+  return value;
+}
+
+/** A GitHub request that did not succeed, with the HTTP status and GitHub's own message. */
+export class GithubRequestError extends Error {
+  constructor(
+    readonly status: number,
+    readonly detail: string,
+    url: string,
+  ) {
+    super(`GitHub request failed (${status}) for ${url}`);
+    this.name = "GithubRequestError";
+  }
+}
+
+export async function githubFetch(
+  url: string,
+  token: string,
+  init: RequestInit = {},
+): Promise<Response> {
+  const response = await fetch(url, {
+    ...init,
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28",
+      "Content-Type": "application/json",
+    },
+  });
+  if (!response.ok) {
+    const payload = (await response.json().catch(() => ({}))) as { message?: unknown };
+    const detail = typeof payload.message === "string" ? payload.message : response.statusText;
+    throw new GithubRequestError(response.status, detail, url);
+  }
+  return response;
+}
+
+export interface IssueComment {
+  id: number;
+  body: string;
+  authorLogin: string;
+}
+
+/** Every comment on an issue or pull request, oldest first. */
+export async function listIssueComments(
+  token: string,
+  base: string,
+  issue: number,
+): Promise<Array<IssueComment>> {
+  const comments: Array<IssueComment> = [];
+  for (let page = 1; ; page++) {
+    const batch = (await (
+      await githubFetch(`${base}/issues/${issue}/comments?per_page=100&page=${page}`, token)
+    ).json()) as Array<{ id: number; body: string | null; user: { login: string } | null }>;
+    comments.push(
+      ...batch.map((entry) => ({
+        id: entry.id,
+        body: entry.body ?? "",
+        authorLogin: entry.user?.login ?? "",
+      })),
+    );
+    if (batch.length < 100) return comments;
+  }
+}

.github/scripts/cli-bench/history.test.ts

@@ -0,0 +1,114 @@
+import { describe, expect, test } from "bun:test";
+import {
+  decodeHistory,
+  headlineOf,
+  makeEntry,
+  MAX_PREVIOUS_RUNS,
+  mergeHistory,
+  renderHistory,
+  type RunEntry,
+} from "./history.ts";
+
+const entry = (n: number, overrides: Partial<RunEntry> = {}): RunEntry => ({
+  sha: n.toString(16).padStart(7, "0"),
+  at: "2026-10-28T09:05Z",
+  headline: "no changes found",
+  url: `https://github.com/o/r/actions/runs/${n}`,
+  ...overrides,
+});
+
+describe("headlineOf", () => {
+  test("reads the title of the rendered report", () => {
+    expect(headlineOf("<!-- cli-bench:pr -->\n\n## CLI benchmark: 2 things to check\n\nbody")).toBe(
+      "2 things to check",
+    );
+  });
+
+  test("falls back when the report has no title", () => {
+    expect(headlineOf("nothing here")).toBe("unknown");
+  });
+});
+
+describe("makeEntry", () => {
+  test("shortens the commit and rounds the time down to the minute in UTC", () => {
+    const made = makeEntry({
+      sha: "0123456789abcdef0123456789abcdef01234567",
+      now: new Date("2026-10-28T09:05:59Z"),
+      headline: "no changes found",
+      url: "https://github.com/o/r/actions/runs/9/attempts/2",
+    });
+
+    expect(made).toMatchObject({ sha: "0123456", at: "2026-10-28T09:05Z" });
+  });
+
+  test("refuses a run link that is not a workflow run", () => {
+    const made = makeEntry({
+      sha: "abcdef1",
+      now: new Date(),
+      headline: "h",
+      url: "https://evil.test/x",
+    });
+
+    expect(made).toBeUndefined();
+  });
+});
+
+describe("mergeHistory", () => {
+  test("puts the new run first", () => {
+    expect(mergeHistory([entry(1)], entry(2)).map((e) => e.sha)).toEqual([
+      entry(2).sha,
+      entry(1).sha,
+    ]);
+  });
+
+  test("keeps the current run plus at most 20 earlier ones, dropping the oldest", () => {
+    const previous = Array.from({ length: 30 }, (_, i) => entry(i + 1));
+
+    const merged = mergeHistory(previous, entry(100));
+
+    expect(merged).toHaveLength(MAX_PREVIOUS_RUNS + 1);
+    expect(merged[0]).toEqual(entry(100));
+    expect(merged.at(-1)).toEqual(entry(MAX_PREVIOUS_RUNS));
+  });
+});
+
+describe("renderHistory and decodeHistory", () => {
+  test("round-trips the entries through the hidden marker", () => {
+    const entries = [entry(3), entry(2), entry(1)];
+
+    expect(decodeHistory(`body\n${renderHistory(entries, (t) => t)}\n`)).toEqual(entries);
+  });
+
+  test("lists earlier runs newest first and leaves the current run out of the list", () => {
+    const rendered = renderHistory(
+      [entry(3), entry(2, { headline: "1 thing to check" })],
+      (t) => t,
+    );
+
+    expect(rendered).toContain("<summary>Previous runs</summary>");
+    expect(rendered).toContain(
+      "- `0000002` · 2026-10-28 09:05 UTC · 1 thing to check · [run](https://github.com/o/r/actions/runs/2)",
+    );
+    expect(rendered).not.toContain("0000003` ·");
+  });
+
+  test("shows no list for a first run", () => {
+    expect(renderHistory([entry(1)], (t) => t)).not.toContain("Previous runs");
+  });
+
+  test.each([
+    ["no marker", "plain comment"],
+    ["not base64 json", "<!-- cli-bench:history bm90IGpzb24= -->"],
+    ["wrong shape", `<!-- cli-bench:history ${Buffer.from('[{"sha":1}]').toString("base64")} -->`],
+    [
+      "a forged run link",
+      `<!-- cli-bench:history ${Buffer.from(JSON.stringify([entry(1, { url: "https://evil.test/x" })])).toString("base64")} -->`,
+    ],
+    [
+      "too many entries",
+      `<!-- cli-bench:history ${Buffer.from(JSON.stringify(Array.from({ length: 22 }, (_, i) => entry(i + 1)))).toString("base64")} -->`,
+    ],
+  ])("treats %s as empty history", (_name, body) => {
+    expect(decodeHistory(body)).toEqual([]);
+  });
+});