Supabase CLI module

[github-actions[bot]]

A discussion dedicated to the Supabase CLI module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
17 / 25	18 / 20	20 / 20	10 / 10	87 / 100

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for both authentication modes (personal access token and external auth), custom install methods, pre-installed binary, internal mirror, and project dashboard link. Each major configuration path is documented with sensible defaults.
Coder-context framing	8	5	README explains what the module adds ("Install Supabase CLI and configure authentication via Coder external auth or access token") and mentions Coder's external auth integration. However, the framing is somewhat generic and doesn't clearly articulate where Coder fits in the developer workflow beyond "adds a dashboard shortcut to the Coder workspace UI." The opening paragraph could better explain the value proposition of having Supabase CLI pre-configured in Coder workspaces.
Visual preview	5	0	No image, GIF, or video in the README. Only an icon reference in frontmatter.

Credential Hygiene — 18 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	14	The access_token and db_password variables are marked sensitive = true in main.tf. However, README examples show access_token = var.supabase_token which is good practice, but the variable declaration example shows variable "supabase_token" { type = string; sensitive = true } without demonstrating how to pass it securely (e.g., via data source or external system). The NOTE "Never hardcode tokens in your template" is present but examples could be more explicit about secure injection methods.
Non-hardcoded auth path	4	4	README documents Coder external auth (OAuth) as the primary authentication method with detailed setup instructions including environment variables and OAuth app creation. This avoids pasting raw keys into templates.

Restricted-Environment Readiness — 20 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	10	The download_base_url variable (default: "https://github.com/supabase/cli/releases/download") allows overriding the download URL. README includes example: "With Internal Mirror" showing download_base_url = "https://artifacts.internal.corp/supabase-cli/releases/download". The install script uses this variable in the download path construction.
Bring-your-own binary	5	5	The skip_install variable is documented with example "Pre-installed Binary (Air-gapped / Golden Image)" showing skip_install = true with note "CLI is already in the image". The install script checks this flag and skips installation while still configuring auth.
Egress transparency	3	3	README has a dedicated "Network Egress" section that enumerates external endpoints: api.github.com, github.com, api.supabase.com, supabase.com, and Homebrew/Scoop repos. Each endpoint lists its purpose and when it's contacted. The section explicitly mentions restricted environments and references download_base_url and skip_install options.
Runs without sudo	2	2	The install script (install.sh.tftpl) attempts sudo for package manager installs (dpkg, rpm, apk) but includes fallback logic: `sudo dpkg -i ...

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All variables have clear descriptions. Sensible defaults are provided (install_method = "detect", supabase_version = "latest", use_external_auth = false). The install_method variable includes validation: condition = contains(["detect", "brew", "scoop", "binary"], var.install_method) with a clear error message. Sensitive variables are properly marked.
Test coverage	4	4	main.tftest.hcl contains 20 test runs covering various configurations (basic, direct token, install methods, versions, db password, external auth, custom icon, pre/post install scripts, app URL variations, skip install, custom download URL). main.test.ts has TypeScript tests covering install method detection, validation, skip_install, custom download_base_url, access_token handling, and end-to-end installation on Ubuntu and Debian containers with actual CLI execution verification.

Overall — 87 / 100

Raw 65 / 75 → round(65 / 75 × 100) = 87

Track: Utility (Supabase CLI is a database/backend tool helper, not an AI agent or IDE)

---

Scored against SCORECARD.md on 2026-08-19 with claude-sonnet-4-5.