Add Ota readiness contract and cross-OS matrix for www/docs workflows#46269
Add Ota readiness contract and cross-OS matrix for www/docs workflows#46269bobaikato wants to merge 34 commits into
Conversation
|
Thanks for contributing to Supabase! ❤️ Our team will review your PR. A few tips for a smoother review process:
|
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
@bobaikato is attempting to deploy a commit to the Supabase Team on Vercel. A member of the Team first needs to authorize it. |
…ion topology export
…ion topology export
…nstallation and execution tasks
bobaikato
force-pushed
the
bobai/supabase-ota-readiness
branch
from
0339232 to
fa3d422
Compare
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds an OTA contract ( ChangesOTA Integration & Testing
Sequence DiagramsequenceDiagram
participant GitHubActions as GitHub Actions
participant Runner as Runner (ubuntu/macos/windows)
participant ota as ota CLI
participant Docker as Docker (when gated)
participant Artifacts as Artifacts (.ota, JSON, logs)
GitHubActions->>Runner: dispatch job (native/container/strict)
Runner->>ota: ota validate -> ota tasks -> ota doctor -> ota proof
Runner->>Docker: probe & run container dry-runs (container job)
ota->>Artifacts: write proof/validation JSON and .ota/ state
Runner->>GitHubActions: upload artifacts on failure
Estimated Code Review Effort🎯 4 (Complex) | ⏱️ ~60 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/test-ota-contract-matrix.yml (1)
51-52: 💤 Low valueConsider adding
persist-credentials: falseto checkout actions.Static analysis flags that Git credentials persist after checkout. While this workflow has read-only
contents: readpermissions reducing the risk, addingpersist-credentials: falseis a defense-in-depth measure that prevents credentials from being accessible to subsequent steps running external tools.Suggested change
- name: Checkout uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: falseAlso applies to: 399-400, 569-570
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/test-ota-contract-matrix.yml around lines 51 - 52, The checkout steps using the actions/checkout action (e.g., the step with "uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" and the other two occurrences flagged) are currently leaving Git credentials persisted; update each checkout step to include the input persist-credentials: false so credentials are not made available to subsequent steps, keeping the rest of the step config unchanged.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/test-ota-contract-matrix.yml:
- Around line 76-78: Replace the mutable tag reference to the ota-run/setup
action with a specific commit hash; locate each occurrence of "uses:
ota-run/setup@v1" (appearing around the three workflow steps that currently use
ota-run/setup@v1) and update them to use the immutable pinned form "uses:
ota-run/setup@<commit-sha>" where <commit-sha> is the full commit hash for the
v1 tag (obtain it via git ls-remote --tags https://github.com/ota-run/setup.git
v1) so all three occurrences match the pinned commit.
In `@ota.yaml`:
- Around line 377-380: The ota installer lines (ota -> sh and ota -> powershell)
currently pipe remote scripts directly into shells; change both to download a
pinned release artifact to a temporary file, verify its SHA256 (or signature)
matches the expected value, and only execute if verification succeeds.
Concretely, update the sh entry to use a pinned URL (include the release
tag/version), curl -fsSLo to save to a file, compute sha256sum and compare
against the hard-coded expected checksum, then run sh <file> on success;
likewise update the powershell entry to use a versioned URL, Invoke-WebRequest
to save to a file, compute and compare the file hash (Get-FileHash -Algorithm
SHA256) against the expected value, and only call iex if the hash matches.
Ensure the expected checksum/signature value is stored alongside these entries
and that failures exit non-zero.
---
Nitpick comments:
In @.github/workflows/test-ota-contract-matrix.yml:
- Around line 51-52: The checkout steps using the actions/checkout action (e.g.,
the step with "uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"
and the other two occurrences flagged) are currently leaving Git credentials
persisted; update each checkout step to include the input persist-credentials:
false so credentials are not made available to subsequent steps, keeping the
rest of the step config unchanged.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 8b2a9baa-8755-4703-9053-0476a8467ce6
📒 Files selected for processing (4)
.github/workflows/test-ota-contract-matrix.yml.gitignoreCONTRIBUTING.mdota.yaml
|
Follow-up: I switched the bootstrap commands back to the canonical Ota installer endpoint () and pinned install target via for both shell paths. This keeps the contributor path aligned with official Ota install guidance while still avoiding floating target version installs. |
|
Correction to previous note (formatting):\n\nFollow-up: I switched the ota.yaml bootstrap commands back to the canonical Ota installer endpoint (https://dist.ota.run/install.sh and https://dist.ota.run/install.ps1) and pinned install target via OTA_VERSION=v1.6.15 for both shell paths. This keeps the contributor path aligned with official Ota install guidance while still avoiding floating target version installs. |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@ota.yaml`:
- Line 379: The OTA_VERSION environment variable is only applied to curl and not
to the installer shell; change the pipeline so the downloaded script runs with
OTA_VERSION in its environment (for example replace `sh: OTA_VERSION=v1.6.15
curl -fsSL https://dist.ota.run/install.sh | sh` with a form that exports
OTA_VERSION to the shell executing the script, e.g. `curl -fsSL
https://dist.ota.run/install.sh | OTA_VERSION=v1.6.15 sh -s --` or invoke the
script via `sh -c` with the variable set); ensure the unique symbols
OTA_VERSION, curl and sh in that line are updated so the installer receives the
pinned version.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 8ce9d9ab-4a63-4eed-b7b6-0cea319c1b74
📒 Files selected for processing (1)
ota.yaml
1 participant
I have read the CONTRIBUTING.md file.
YES
What kind of change does this PR introduce?
Developer experience and CI/docs update: add an optional Ota readiness contract and a cross-OS contract validation matrix for the scoped www/docs workflows.
What is the current behavior?
This repository has strong setup docs, but no machine-readable readiness contract for the www/docs slice and no dedicated cross-OS readiness matrix around that contract.
What is the new behavior?
Matrix run on this branch (rebased head) passed:
Additional context
Summary by CodeRabbit
New Features
Documentation
Chores