Supabase CLI module

[github-actions[bot]]

A discussion dedicated to the Supabase CLI module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	20 / 20	19 / 20	10 / 10	91 / 100

Drilldown

Track: Utility (Supabase CLI installer/auth helper; not an AI agent or IDE)

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README has distinct, well-documented examples for each major mode: PAT auth, External Auth (OAuth), project dashboard linking, custom install method, pre-installed binary (air-gapped), and internal mirror — each with sensible defaults.
Visual preview	5	0	No image, GIF, or video embedded in the README.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	access_token and db_password are declared sensitive = true in main.tf. README examples use var.supabase_token references, not inline literal/placeholder keys, and explicitly warn "Never hardcode tokens in your template."
Non-hardcoded auth path	4	4	External auth (OAuth) is documented in detail with CODER_EXTERNAL_AUTH_* env vars and OAuth app setup steps in the Supabase dashboard.

Restricted-Environment Readiness — 19 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	5	The download_base_url variable (default https://github.com/supabase/cli/releases/download) overrides the exact URL used in install_binary/install_native_package ($${DOWNLOAD_BASE_URL}/v$${version}/supabase_...). Documented via the "With Internal Mirror" example.
Bring-your-own binary	10	10	skip_install = true documented with a dedicated "Pre-installed Binary (Air-gapped / Golden Image)" example; auth env vars still configured.
Egress transparency	3	3	Dedicated "Network Egress" README section enumerates actual endpoints (api.github.com, github.com, api.supabase.com, supabase.com, Homebrew/Scoop repos) with purpose and timing, plus a note on restricted-environment usage.
Runs without sudo	2	1	Script checks for sudo before using it for native package installs (dpkg/rpm/apk), and falls back to binary install (no sudo) on failure or absence — this is sudo-for-an-optional-install-path with a working fallback, matching the half-credit case exactly.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	Variables have clear descriptions and sensible defaults (e.g., install_method default detect, supabase_version default latest); install_method has a validation block restricting to valid values.
Test coverage	4	4	main.tftest.hcl covers business logic extensively (install method variants, app URL logic, skip_install, db_password, custom auth id, etc.), and main.test.ts adds real container-based end-to-end install tests (Ubuntu/Debian binary install, symlink to CODER_SCRIPT_BIN_DIR).

Overall — 91 / 100

Raw 61 / 67 → round(61 / 67 × 100) = 91

---

Scored against SCORECARD.md on 2026-11-09 with solstice-1.