From ff27cb0cc596bb6df04166c0aa95c84a9028d225 Mon Sep 17 00:00:00 2001 From: Max Ghenis Date: Sun, 11 Oct 2026 19:17:41 -0400 Subject: [PATCH] CI: a failed Supabase publish is a warning, not a red main Every main run since 6 October 2026 has failed in "publish db to supabase storage" with curl exit 6: the storage host in SUPABASE_SCORECARD_URL no longer resolves. Both secrets are unchanged since 20 August and the last upload that worked was 28 September, so the target itself went away. The tests and the build pass on those runs, but main shows red, which hides whether main is otherwise green. Nothing in this repository reads the published copy, and the built database is already attached to each run as an artifact. A failed upload now emits a warning annotation and a job-summary line and exits 0; a working upload and the no-secrets skip are unchanged. curl stays silent so the host name in the secret URL is never printed. Restoring or retiring the publish target is a separate decision. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4d6bc6f9..5c915ea5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -81,6 +81,14 @@ jobs: # plus a moving latest.db.gz, so consumers fetch + gunzip instead # of rebuilding. Skips with a notice until the # SUPABASE_SCORECARD_URL/KEY secrets are set. + # + # A failed upload is a warning, not a failed run: nothing in this + # repository reads the published copy, and the built database is + # already attached to the run as an artifact. Every main run from + # 6 October 2026 failed here with curl exit 6 (the storage host no + # longer resolves; the last upload that worked was 28 September), + # which hid whether main was otherwise green. curl stays silent so + # the host name in the secret URL is never printed. - run: | if [ -z "$SUPABASE_URL" ] || [ -z "$SUPABASE_KEY" ]; then echo "::notice::Supabase secrets not set — skipping publish" @@ -88,12 +96,19 @@ jobs: fi gzip -9 -c scorecard.db > scorecard.db.gz for name in "${GITHUB_SHA}.db.gz" "latest.db.gz"; do + status=0 curl -sf -X POST \ "$SUPABASE_URL/storage/v1/object/scorecard-artifacts/$name" \ -H "Authorization: Bearer $SUPABASE_KEY" \ -H "Content-Type: application/gzip" \ -H "x-upsert: true" \ - --data-binary @scorecard.db.gz > /dev/null + --data-binary @scorecard.db.gz > /dev/null || status=$? + if [ "$status" -ne 0 ]; then + message="curl exit $status uploading scorecard-artifacts/$name: the published database was not updated. This run's built database is its scorecard-db artifact." + echo "::warning title=Supabase publish failed::$message" + echo "**Supabase publish failed.** $message" >> "$GITHUB_STEP_SUMMARY" + exit 0 + fi echo "uploaded scorecard-artifacts/$name" done env: