Skip to content

CI: a failed Supabase publish is a warning, not a red main - #167

Draft
MaxGhenis wants to merge 1 commit into
mainfrom
w6/publish-warning
Draft

MaxGhenis wants to merge 1 commit into
mainfrom
w6/publish-warning

Conversation

@MaxGhenis

Copy link
Copy Markdown
Contributor

What

The publish db to supabase storage job has failed on every main run since 6 October 2026 with curl exit 6 (host not resolved). This makes a failed upload a visible warning (annotation plus job-summary line) and lets the run pass.

Evidence

  • Last successful publish: main run on 2026-09-28T13:21Z. First failure: 2026-10-06T10:50Z; every main push since has failed in this job only (pytest · ruff format and typecheck · build pass).
  • gh secret list shows SUPABASE_SCORECARD_URL and SUPABASE_SCORECARD_KEY unchanged since 2026-08-20, and the job does not take its "secrets not set" skip, so the URL is set and its host no longer resolves.
  • Nothing on main reads the published copy (git grep for supabase, scorecard-artifacts, latest.db.gz finds only this job and scorecard_db/README.md). Each run still attaches the built database as an artifact.

Behaviour

Case Before After
Upload works uploads both objects unchanged
Secrets not set notice, exit 0 unchanged
Upload fails job fails, main red ::warning, job-summary line, exit 0

I ran the step's script locally in all three cases (an unresolvable host, empty secrets, a local HTTP server); it is shellcheck-clean. curl stays silent so the host name in the secret URL is never printed.

Not in this PR

Restoring the Supabase project or secret, or retiring the publish, needs someone with access to the Supabase account (queued for Max).

axiom: n/a: CI infrastructure.

🤖 Generated with Claude Code

Every main run since 6 October 2026 has failed in "publish db to supabase
storage" with curl exit 6: the storage host in SUPABASE_SCORECARD_URL no
longer resolves. Both secrets are unchanged since 20 August and the last
upload that worked was 28 September, so the target itself went away. The
tests and the build pass on those runs, but main shows red, which hides
whether main is otherwise green.

Nothing in this repository reads the published copy, and the built
database is already attached to each run as an artifact. A failed upload
now emits a warning annotation and a job-summary line and exits 0; a
working upload and the no-secrets skip are unchanged. curl stays silent so
the host name in the secret URL is never printed.

Restoring or retiring the publish target is a separate decision.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@vercel

vercel Bot commented Oct 11, 2026 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
policyengine-scorecard Ready Ready Preview Oct 11, 2026 11:18pm UTC

Request Review

This branch was successfully deployed

1 active deployment
Preview — ff27cb0c Deployed Oct 11, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant