[Programcode]

Each Supabase CLI version pulls its own ~7 GB set of local Docker images. On the VPS, /usr/local/bin/supabase was 2.116.0 (what T3 threads and non-login shells hit) and the npm-global CLI was 2.121.0 (login shells), so today worktrees pulled both sets and filled the disk.

What changes

• supabase is now an exact devDependency: 2.121.0 (no ^). npm ci installs it, and npm run scripts (test:db, backend:status) resolve it from node_modules/.bin.
• .superset/lib/supabase-cli.sh puts the pinned CLI first on PATH. .superset/db-gate.sh, .superset/teardown.sh, scripts/agent-stack.sh and the verify harness source it. It fails with "run npm ci" if the pinned CLI is missing; teardown just skips.
• CI supabase/setup-cli steps go from 2.116.0 to 2.121.0, so CI and local match.
• AGENTS.md: use only the repo-pinned CLI, never a global or npx supabase@latest, and bump package.json, the lockfile and the workflows together. Docs now say 2.121.0, and the outside-Superset commands use npx supabase.
• db-gate.test.ts points the gate at its stub CLI through DEBATELAB_SUPABASE_BIN_DIR.

2.121.0 is the newer version, and scripts/agent-stack.sh already needed 2.121+ for the Docker-free stack engine.

scripts/staging-sync.mjs still uses the CLI on PATH on purpose, because the staging timer never runs npm install. The VPS global CLI is aligned to 2.121.0 separately.

No migrations, no DB changes, no app code.

Verification

• npm run verify passes locally on the VPS: docs, lint (including knip), typecheck, unit, collaboration, edge, build, service worker, and 43/43 smoke tests.
• bash -n passes on all changed shell scripts.

Summary by CodeRabbit

• Chores
  • Standardized local development and automated workflows on Supabase CLI version 2.121.0.
  • Updated setup and testing guidance to reflect the pinned CLI version and its installation requirements.
  • Improved consistency when database tools select and use the repository’s Supabase CLI.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

ℹ️ Recent review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Programcode/DebateLab
• Branch: chore/pin-supabase-cli
• File: .coderabbit.yaml
• Commit: b9870ca
• Layers: Repository YAML (base), Organization UI (inherited)
• Review profile: CHILL
• Plan: Free
• Run ID: d9ea3890-06d5-4897-b401-db0d21b7e24f

📥 Commits

Reviewing files that changed from the base of the PR and between 17c00f9 and b9870ca.

⛔ Files ignored due to path filters: 1

• package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing: 16

• .claude/skills/verify-debatelab/bin/verify.sh
• .github/workflows/agentic-e2e.yml
• .github/workflows/database.yml
• .github/workflows/live-e2e.yml
• .github/workflows/model-matrix.yml
• .superset/db-gate.sh
• .superset/lib/supabase-cli.sh
• .superset/teardown.sh
• AGENTS.md
• README.md
• docs/development.md
• docs/testing.md
• package.json
• scripts/agent-stack.sh
• src/test/scripts/db-gate.test.ts
• supabase/README.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The repository pins Supabase CLI to version 2.121.0 in its development dependency and CI workflows. Database instructions use the pinned CLI through npx. Repository scripts select a local or configured CLI binary through a shared helper.

Changes: Supabase CLI pinning

Layer / File(s)	Summary
Pin CLI version across development and CI package.json, .github/workflows/*, AGENTS.md, README.md, docs/development.md, docs/testing.md, supabase/README.md	The development dependency and workflow setup steps specify Supabase CLI 2.121.0. Database instructions document the pin and use npx supabase commands.
Select the pinned CLI in repository scripts .superset/lib/supabase-cli.sh, .superset/db-gate.sh, .superset/teardown.sh, .claude/skills/verify-debatelab/bin/verify.sh, scripts/agent-stack.sh, src/test/scripts/db-gate.test.ts	The shared helper selects the configured or repository-local binary directory and adds it to PATH when it contains an executable supabase. Repository scripts invoke the helper. Teardown exits successfully if CLI selection fails, and the database-gate test supplies a temporary binary directory.

Estimated code review effort: 2 (Simple) | ~10 minutes

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}

[Programcode]

Local evidence at b9870ca (Actions jobs fail in 1-2 s with no runner, so out of minutes; this is a local pass, not a CI pass):

• npm run verify: passed (43/43 smoke).
• ./.superset/db-gate.sh --db-only with the pinned CLI 2.121.0: pgTAP Files=24, Tests=458, Result: PASS, plus all database scripts. EXIT=0, the stack stopped afterwards, and no new images were pulled (it reused the 2.121.0 set).