[pull] master from supabase:master

.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'weekly'

.github/workflows/ai-tests.yml

@@ -32,21 +32,21 @@ jobs:
         working-directory: ./packages/ai-commands
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           sparse-checkout: |
             packages
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         name: Install pnpm
         with:
           run_install: false
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.nvmrc'
           cache: 'pnpm'
       - name: Install deps
-        run: pnpm i
+        run: pnpm install --frozen-lockfile
       - name: Type check
         run: pnpm run typecheck
       - name: Run tests

.github/workflows/auto-label-issues.yml

@@ -8,26 +8,27 @@ jobs:
     permissions:
       issues: write
     steps:
-    - name: Check if organization member
-      id: is-org-member
-      uses: JamesSingleton/is-organization-member@1.0.0
-      with:
-        organization: ${{ github.repository_owner }}
-        username: ${{ github.event.issue.user.login }}
-        token: ${{ secrets.GITHUB_TOKEN }}
-    - name: label-member
-      env:
-        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        GH_REPO: ${{ github.repository }}
-        NUMBER: ${{ github.event.issue.number }}
-      run: |
-        if [ ${{ steps.is-org-member.outputs.result }} != "true" ]; then
-          echo "User is outside of organization, labeling external"
-          gh issue edit "$NUMBER" --add-label "external-issue"
-        else
-          echo "User is within the organization, labeling internal"
-          gh issue edit "$NUMBER" --add-label "internal-issue"
-        fi
+      - name: Check if organization member
+        id: is-org-member
+        uses: JamesSingleton/is-organization-member@39c59b3b17cca4eb75c81772b95e724e2a24c025 # v1.0.0
+        with:
+          organization: ${{ github.repository_owner }}
+          username: ${{ github.event.issue.user.login }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: label-member
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+          NUMBER: ${{ github.event.issue.number }}
+          IS_INTERNAL: ${{ steps.is-org-member.outputs.result }}
+        run: |
+          if [ "$IS_INTERNAL" != "true" ]; then
+            echo "User is outside of organization, labeling external"
+            gh issue edit "$NUMBER" --add-label "external-issue"
+          else
+            echo "User is within the organization, labeling internal"
+            gh issue edit "$NUMBER" --add-label "internal-issue"
+          fi
   triage-new:
     runs-on: ubuntu-latest
     permissions:

.github/workflows/autofix_linters.yml

@@ -23,7 +23,7 @@ jobs:
       - name: Calculate number of commits
         run: echo "PR_FETCH_DEPTH=$(( ${{ github.event.pull_request.commits }} + 1 ))" >> "${GITHUB_ENV}"
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           ref: ${{ github.head_ref }}
           token: ${{ secrets.PAT_AUTOFIX }}
@@ -32,23 +32,23 @@ jobs:
             packages
             apps
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         name: Install pnpm
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.nvmrc'
           cache: pnpm
 
       - name: Install required dependencies
-        run: pnpm i
+        run: pnpm install --frozen-lockfile
 
       - name: Run Prettier in fix mode
         run: pnpm run format
 
       - name: Commit changes and push to existing branch
-        uses: stefanzweifel/git-auto-commit-action@v5
+        uses: stefanzweifel/git-auto-commit-action@b863ae1933cb653a53c021fe36dbb774e1fb9403 # v5.2.0
         with:
-          commit_message: "ci: Autofix updates from GitHub workflow"
-          commit_user_name: "kevcodez"
-          commit_user_email: "k.grueneberg1994@gmail.com"
+          commit_message: 'ci: Autofix updates from GitHub workflow'
+          commit_user_name: 'kevcodez'
+          commit_user_email: 'k.grueneberg1994@gmail.com'

.github/workflows/avoid-typos.yml

@@ -17,9 +17,9 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
       - name: Check out code.
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
       - name: misspell
-        uses: reviewdog/action-misspell@v1
+        uses: reviewdog/action-misspell@9daa94af4357dddb6fd3775de806bc0a8e98d3e4 # v1.26.3
         with:
           github_token: ${{ secrets.github_token }}
           locale: 'US'

.github/workflows/docs-js-libs-update.yml

@@ -22,23 +22,23 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           ref: master
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         name: Install pnpm
         with:
           run_install: false
 
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.nvmrc'
           cache: 'pnpm'
 
       - name: Install deps
-        run: pnpm i
+        run: pnpm install --frozen-lockfile
 
       - name: Regenerate JS client libraries tsdoc files
         working-directory: apps/docs/spec
@@ -55,7 +55,7 @@ jobs:
           npx vitest run --update ./features/docs/Reference.typeSpec.test.ts
 
       - name: Create pull request
-        uses: peter-evans/create-pull-request@v6
+        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: 'docs: update js client libraries (${{ github.event.inputs.version }})'

.github/workflows/docs-last-changed.yml

@@ -23,24 +23,24 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
           sparse-checkout: |
             apps/docs
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         name: Install pnpm
         with:
           run_install: false
 
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.nvmrc'
 
       - name: Download dependencies
-        run: pnpm i
+        run: pnpm install --frozen-lockfile
 
       - name: Update last-changed dates
         working-directory: ./apps/docs

.github/workflows/docs-lint-v2-comment.yml

@@ -25,7 +25,7 @@ jobs:
     steps:
       - id: download_artifact
         name: 'Download artifact'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const artifacts = await github.rest.actions.listWorkflowRunArtifacts({
@@ -53,7 +53,7 @@ jobs:
         run: unzip lint_results.zip
       - name: 'Comment on PR'
         if: steps.download_artifact.outputs.contains_results == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const fs = require('fs');

.github/workflows/docs-lint-v2-scheduled.yml

@@ -15,7 +15,7 @@ jobs:
   lint-all:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
           sparse-checkout: |
@@ -24,7 +24,7 @@ jobs:
             apps/docs/content
       - name: cache cargo
         id: cache-cargo
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.cargo/bin/

.github/workflows/docs-lint-v2.yml

@@ -28,14 +28,14 @@ jobs:
     name: supa-mdx-lint
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           fetch-depth: 0
           sparse-checkout: |
             supa-mdx-lint.config.toml
             supa-mdx-lint
             apps/docs/content
-      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 #v3.0.2
+      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: filter
         with:
           filters: |
@@ -98,7 +98,7 @@ jobs:
           fi
       - name: save results as artifact (external)
         if: steps.filter.outputs.docs == 'true' && github.event.pull_request.head.repo.full_name != github.repository && steps.external_lint.outputs.LINT_EXIT_CODE != 0
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: lint_results
           path: __github_actions__pr/

.github/workflows/docs-mgmt-api-update.yml

@@ -15,32 +15,32 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           ref: master
           sparse-checkout: |
             apps/docs
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         name: Install pnpm
         with:
           run_install: false
 
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.nvmrc'
           cache: 'pnpm'
 
       - name: Install deps
-        run: pnpm i
+        run: pnpm install --frozen-lockfile
 
       - name: Change to apps/docs/spec directory and run make command
         working-directory: apps/docs/spec
         run: make download.api.v1 dereference.api.v1 generate.sections.api.v1 format
 
       - name: Create pull request
-        uses: peter-evans/create-pull-request@v6
+        uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: 'feat: update mgmt api docs'

.github/workflows/docs-sync-troubleshooting.yml

@@ -24,27 +24,27 @@ jobs:
       SUPABASE_SECRET_KEY: ${{ secrets.SEARCH_SUPABASE_SERVICE_ROLE_KEY }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           sparse-checkout: |
             apps/docs
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         name: Install pnpm
         with:
           run_install: false
 
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.nvmrc'
           cache: 'pnpm'
 
       - name: Install dependencies
-        run: pnpm i
+        run: pnpm install --frozen-lockfile
 
       - name: Run Troubleshooting script
-        run: pnpm run -F docs troubleshooting:sync
+        run: pnpm run --filter docs troubleshooting:sync
 
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5

.github/workflows/docs-sync.yml

@@ -26,25 +26,25 @@ jobs:
       SUPABASE_SECRET_KEY: ${{ secrets.SEARCH_SUPABASE_SERVICE_ROLE_KEY }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           sparse-checkout: |
             apps/docs
             packages
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         name: Install pnpm
         with:
           run_install: false
 
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.nvmrc'
           cache: 'pnpm'
 
       - name: Install dependencies
-        run: pnpm i
+        run: pnpm install --frozen-lockfile
 
       - name: Run sync script
-        run: pnpm run -F docs sync
+        run: pnpm run --filter docs sync

.github/workflows/docs-tests-smoke.yml

@@ -19,25 +19,25 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
         with:
           sparse-checkout: |
             apps/docs
             packages
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
         name: Install pnpm
         with:
           run_install: false
 
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.nvmrc'
           cache: 'pnpm'
 
       - name: Install deps
-        run: pnpm i
+        run: pnpm install --frozen-lockfile
 
       - name: Run tests
         run: pnpm --prefix="apps/docs" run test:smoke