refactor: use Supabase service role key for worker authentication

[jumski]

Use Supabase Service Role Key for Worker Authentication

This PR simplifies the authentication mechanism for workers by leveraging the SUPABASE_SERVICE_ROLE_KEY that's automatically available in Edge Functions, eliminating the need for a separate PGFLOW_SECRET_KEY.

Changes:

• Workers now authenticate with the Control Plane using the Supabase service role key
• Removed the secretKey option from ControlPlaneOptions interface
• Updated the verifyAuth function to check against SUPABASE_SERVICE_ROLE_KEY environment variable
• Modified tests to properly set and clean up the environment variable during testing
• Added a test case for when the service role key is not set in the environment

This change reduces configuration overhead as both Control Plane and Worker Edge Functions automatically have access to this key via Deno.env.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 2c6cde0

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[jumski]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• feat: add advisory locks to prevent concurrent flow compilation race conditions #477
• refactor: remove ensure-compiled endpoint and related code from control plane #476
• refactor: simplify environment detection for flow compilation mode #475
• feat: add flow compilation verification at worker startup #474
• feat: add secure local development detection for flow compilation #473
• refactor: use Supabase service role key for worker authentication #472 👈 (View in Graphite)
• feat: include options in FlowShape for proper flow creation #471
• feat: add ensure-compiled endpoint to control plane server #467
• feat: add ensure_flow_compiled function with dev/prod mode support #466
• feat: add flow compilation utilities for creating flows from JSON shapes #465
• feat: add SQL functions to compare and retrieve flow shapes #464
• Setup Worker Startup Compilation Phase 1 #463
• main

---

How to use the Graphite Merge Queue

Add either label to this PR to merge it via the merge queue:

• merge:queue - adds this PR to the back of the merge queue
• hotfix:queue - for urgent hot fixes, skip the queue and merge this PR next

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

[nx-cloud]

View your CI Pipeline Execution ↗ for commit 2c6cde0

Command	Status	Duration	Result
nx affected -t verify-exports --base=origin/mai...	✅ Succeeded	3s	View ↗
nx affected -t build --configuration=production...	✅ Succeeded	25s	View ↗
nx affected -t lint typecheck test --parallel -...	✅ Succeeded	5m 2s	View ↗

---

☁️ Nx Cloud last updated this comment at 2025-11-30 18:03:57 UTC

[github-actions]

🔍 Preview Deployment: Website

✅ Deployment successful!

🔗 Preview URL: https://pr-472.pgflow.pages.dev

📝 Details:

• Branch: 11-30-use_supabase_service_role_key_for_controlplane_auth_zero-config_
• Commit: 5e775fabc819c93ff5376869c9e4e25e31b0233c
• View Logs

_Last updated: _