Prod deploy

.github/CODEOWNERS

@@ -1 +1 @@
-* @supabase/cli
+* @supabase/cli

.github/actions/setup/action.yml

@@ -0,0 +1,58 @@
+name: Setup
+
+description: Perform standard setup and install dependencies using pnpm
+
+runs:
+  using: "composite"
+  steps:
+    - name: Resolve Bun version
+      shell: bash
+      run: echo "BUN_VERSION=1.3.13" >> "$GITHUB_ENV"
+
+    - name: Restore Bun toolchain cache
+      id: bun-toolchain-cache
+      uses: actions/cache@v4
+      with:
+        path: /opt/hostedtoolcache/bun
+        key: bun-toolchain-${{ runner.os }}-${{ runner.arch }}-${{ env.BUN_VERSION }}
+
+    - name: Install Bun
+      id: install-bun
+      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
+      continue-on-error: true
+      with:
+        bun-version: ${{ env.BUN_VERSION }}
+
+    - name: Install Bun (fallback with retries)
+      if: steps.install-bun.outcome == 'failure'
+      uses: nick-fields/retry@v3
+      with:
+        timeout_minutes: 3
+        max_attempts: 5
+        retry_wait_seconds: 30
+        command: |
+          curl -fsSL https://bun.sh/install | bash -s "bun-v${BUN_VERSION}"
+          echo "$HOME/.bun/bin" >> "$GITHUB_PATH"
+
+    - name: Verify Bun
+      shell: bash
+      run: bun --version
+
+    - name: Install Node.js
+      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+      with:
+          node-version-file: .nvmrc
+          package-manager-cache: false
+
+    - name: Enable Corepack
+      shell: bash
+      run: npm install --global --force corepack && corepack enable
+
+    - name: Configure dependency cache
+      uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6
+      with:
+        cache: pnpm
+
+    - name: Install dependencies
+      shell: bash
+      run: pnpm install --frozen-lockfile

.github/workflows/api-sync.yml → .github/workflows/cli-go-api-sync.yml

@@ -5,8 +5,6 @@ on:
     types:
       - api-sync
   workflow_dispatch: # allow manual triggering
-
-# Add explicit permissions
 permissions:
   contents: write
   pull-requests: write
@@ -20,7 +18,7 @@ jobs:
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version-file: go.mod
+          go-version-file: apps/cli-go/go.mod
           cache: true
 
       - name: Run codegen
@@ -70,3 +68,6 @@ jobs:
         run: gh pr merge --auto --squash "${{ steps.cpr.outputs.pull-request-number }}"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+defaults:
+  run:
+    working-directory: apps/cli-go

.github/workflows/ci.yml → .github/workflows/cli-go-ci.yml

@@ -2,10 +2,16 @@ name: CI
 
 on:
   pull_request:
+    paths:
+      - apps/cli-go/**
   merge_group:
+    paths:
+      - apps/cli-go/**
   push:
     branches:
       - develop
+    paths:
+      - apps/cli-go/**
 
 permissions:
   contents: read
@@ -19,7 +25,7 @@ jobs:
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version-file: go.mod
+          go-version-file: apps/cli-go/go.mod
           cache: true
 
       # Required by: internal/utils/credentials/keyring_test.go
@@ -32,7 +38,7 @@ jobs:
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: code-coverage-report
-          path: coverage.out
+          path: apps/cli-go/coverage.out
 
   coverage:
     name: Coverage
@@ -56,7 +62,7 @@ jobs:
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version-file: go.mod
+          go-version-file: apps/cli-go/go.mod
           # Linter requires no cache
           cache: false
 
@@ -65,6 +71,7 @@ jobs:
           args: --timeout 5m --verbose
           version: latest
           only-new-issues: true
+          working-directory: apps/cli-go
 
   start:
     name: Start
@@ -73,7 +80,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version-file: go.mod
+          go-version-file: apps/cli-go/go.mod
           cache: true
       - run: go build main.go
       - run: ./main init
@@ -90,13 +97,14 @@ jobs:
 
   link:
     name: Link
-    if: ${{ github.event_name == 'merge_group' || (github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork) }}
+    if: ${{ github.event_name == 'merge_group' || (github.event_name ==
+      'pull_request' && !github.event.pull_request.head.repo.fork) }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version-file: go.mod
+          go-version-file: apps/cli-go/go.mod
           cache: true
       - run: go build main.go
       - run: ./main link
@@ -112,7 +120,7 @@ jobs:
 
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version-file: go.mod
+          go-version-file: apps/cli-go/go.mod
           cache: true
 
       - run: go generate
@@ -122,3 +130,6 @@ jobs:
             git diff
             exit 1
           fi
+defaults:
+  run:
+    working-directory: apps/cli-go

.github/workflows/codeql-analysis.yml → .github/workflows/cli-go-codeql.yml

@@ -13,10 +13,16 @@ name: "CodeQL"
 
 on:
   pull_request:
+    paths:
+      - apps/cli-go/**
   merge_group:
+    paths:
+      - apps/cli-go/**
   push:
     branches:
       - develop
+    paths:
+      - apps/cli-go/**
 
 jobs:
   analyze:
@@ -72,12 +78,12 @@ jobs:
           # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
           # queries: security-extended,security-and-quality
 
-      # If the analyze step fails for one of the languages you are analyzing with
-      # "We were unable to automatically build your code", modify the matrix above
-      # to set the build mode to "manual" for that language. Then modify this step
-      # to build your code.
-      # ℹ️ Command-line programs to run using the OS shell.
-      # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+          # If the analyze step fails for one of the languages you are analyzing with
+          # "We were unable to automatically build your code", modify the matrix above
+          # to set the build mode to "manual" for that language. Then modify this step
+          # to build your code.
+          # ℹ️ Command-line programs to run using the OS shell.
+          # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
       - if: matrix.build-mode == 'manual'
         shell: bash
         run: |
@@ -92,3 +98,6 @@ jobs:
         uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
         with:
           category: "/language:${{matrix.language}}"
+defaults:
+  run:
+    working-directory: apps/cli-go

.github/workflows/mirror-image.yml → .github/workflows/cli-go-mirror-image.yml

@@ -15,6 +15,8 @@ on:
         description: "org/image:tag"
         required: true
         type: string
+    paths:
+      - apps/cli-go/**
 
 permissions:
   contents: read
@@ -48,3 +50,6 @@ jobs:
           dst: |
             public.ecr.aws/supabase/${{ steps.strip.outputs.image }}
             ghcr.io/supabase/${{ steps.strip.outputs.image }}
+defaults:
+  run:
+    working-directory: apps/cli-go

.github/workflows/mirror.yml → .github/workflows/cli-go-mirror.yml

@@ -15,7 +15,8 @@ on:
   #
   # TODO: Make the cli start test run *after* we mirror images (if needed).
   workflow_dispatch:
-
+    paths:
+      - apps/cli-go/**
 permissions:
   contents: read
 
@@ -29,7 +30,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
-          go-version-file: go.mod
+          go-version-file: apps/cli-go/go.mod
           cache: true
       - id: list
         run: |
@@ -58,3 +59,6 @@ jobs:
     with:
       image: ${{ matrix.src }}
     secrets: inherit
+defaults:
+  run:
+    working-directory: apps/cli-go

.github/workflows/pg-prove.yml → .github/workflows/cli-go-pg-prove.yml

@@ -2,7 +2,8 @@ name: Publish pg_prove
 
 on:
   workflow_dispatch:
-
+    paths:
+      - apps/cli-go/**
 permissions:
   contents: read
 
@@ -33,7 +34,7 @@ jobs:
     strategy:
       matrix:
         include:
-          - runner: [self-hosted, X64]
+          - runner: [ self-hosted, X64 ]
             arch: amd64
           - runner: arm-runner
             arch: arm64
@@ -58,7 +59,8 @@ jobs:
           tags: ${{ needs.settings.outputs.image_tag }}_${{ matrix.arch }}
           platforms: linux/${{ matrix.arch }}
           cache-from: type=gha,scope=${{ github.ref_name }}-pg_prove-${{ matrix.arch }}
-          cache-to: type=gha,mode=max,scope=${{ github.ref_name }}-pg_prove-${{ matrix.arch }}
+          cache-to: type=gha,mode=max,scope=${{ github.ref_name }}-pg_prove-${{
+            matrix.arch }}
 
   merge_manifest:
     needs:
@@ -86,3 +88,6 @@ jobs:
     with:
       image: ${{ needs.settings.outputs.image_tag }}
     secrets: inherit
+defaults:
+  run:
+    working-directory: apps/cli-go

.github/workflows/publish-migra.yml → .github/workflows/cli-go-publish-migra.yml

@@ -2,7 +2,8 @@ name: Publish migra
 
 on:
   workflow_dispatch:
-
+    paths:
+      - apps/cli-go/**
 permissions:
   contents: read
 
@@ -33,7 +34,7 @@ jobs:
     strategy:
       matrix:
         include:
-          - runner: [self-hosted, X64]
+          - runner: [ self-hosted, X64 ]
             arch: amd64
           - runner: arm-runner
             arch: arm64
@@ -58,7 +59,8 @@ jobs:
           tags: ${{ needs.settings.outputs.image_tag }}_${{ matrix.arch }}
           platforms: linux/${{ matrix.arch }}
           cache-from: type=gha,scope=${{ github.ref_name }}-migra-${{ matrix.arch }}
-          cache-to: type=gha,mode=max,scope=${{ github.ref_name }}-migra-${{ matrix.arch }}
+          cache-to: type=gha,mode=max,scope=${{ github.ref_name }}-migra-${{ matrix.arch
+            }}
 
   merge_manifest:
     needs:
@@ -86,3 +88,6 @@ jobs:
     with:
       image: ${{ needs.settings.outputs.image_tag }}
     secrets: inherit
+defaults:
+  run:
+    working-directory: apps/cli-go

.github/workflows/tag-pkg.yml → .github/workflows/cli-go-tag-pkg.yml

@@ -7,6 +7,8 @@ on:
         description: "pkg version to tag (e.g. v1.2.2)"
         required: true
         type: string
+    paths:
+      - apps/cli-go/**
 
 permissions:
   contents: write
@@ -35,3 +37,6 @@ jobs:
           fi
           git tag "$TAG"
           git push origin "$TAG"
+defaults:
+  run:
+    working-directory: apps/cli-go

.github/workflows/deploy-check.yml

@@ -10,7 +10,7 @@ on:
     branches:
       - main
 
-permissions: 
+permissions:
   contents: read
 
 jobs:

.github/workflows/deploy.yml

@@ -14,7 +14,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
       - id: app-token