chore: production deploy

.bun-version

@@ -1 +1 @@
-1.4.2
+1.4.4

.gitattributes

@@ -14,28 +14,21 @@ apps/cli/src/shared/telemetry/__fixtures__/error-tags.txt text eol=lf
 # statistics and collapses them in pull request diffs -- they are build output to
 # be regenerated, not code to review, and together they outweigh the hand-written
 # source. The attribute is GitHub-only: git, CI, and local diffs are unaffected.
-# Collapsed is not hidden. v1-openapi.yaml and the lockfiles do carry changes
-# worth reading -- an upstream API change, a dependency substitution -- and both
-# stay one click away in review.
-# Regeneration is owned by `go generate` in apps/cli-go and by the `generate`
-# turbo task, whose `outputs` in turbo.json are the source of truth for this list.
-# Only the generated files are listed, not their hand-written inputs
-# (pkg/api/*.cfg.yaml, api/overlay.yaml). apps/docs/content/docs/commands/ is
-# generated too but gitignored, so it needs no entry.
-apps/cli-go/api/v1-openapi.yaml linguist-generated=true
-apps/cli-go/pkg/api/*.gen.go linguist-generated=true
+# Collapsed is not hidden. The lockfile does carry changes worth reading --
+# a dependency substitution -- and stays one click away in review.
+# Regeneration is owned by the `generate` turbo task, whose `outputs` in
+# turbo.json are the source of truth for this list. Only the generated files
+# are listed, not their hand-written inputs. apps/docs/content/docs/commands/
+# is generated too but gitignored, so it needs no entry.
 packages/api/src/generated/* linguist-generated=true
 packages/api/scripts/openapi-source.json linguist-generated=true
 packages/stack/src/functions/generated/* text eol=lf linguist-generated=true
 apps/cli/src/shared/feedback/database.types.ts linguist-generated=true
-apps/docs/public/cli/config.schema.json linguist-generated=true
-apps/docs/public/cli/project-config.schema.json linguist-generated=true
-apps/docs/public/cli/supabase-lock/v1.schema.json linguist-generated=true
+apps/docs/public/schemas/** linguist-generated=true
 
 # Lockfiles. Collapsed rather than hidden -- a dependency change is still one
 # click away in review, which is the same treatment GitHub gives package-lock.json.
 pnpm-lock.yaml linguist-generated=true
-apps/cli-go/go.sum linguist-generated=true
 
 # Not a language marker -- this is the service image manifest, not a container build.
 apps/cli/src/shared/services/Dockerfile linguist-detectable=false

.github/CODEOWNERS

@@ -10,15 +10,8 @@
 /tools/*/package.json @supabase/cli @supabase-oss
 /pnpm-lock.yaml @supabase/cli @supabase-oss
 /pnpm-workspace.yaml @supabase/cli @supabase-oss
-/apps/cli-go/go.mod @supabase/cli @supabase-oss
-/apps/cli-go/go.sum @supabase/cli @supabase-oss
-/apps/cli-go/pkg/go.mod @supabase/cli @supabase-oss
-/apps/cli-go/pkg/go.sum @supabase/cli @supabase-oss
 /apps/cli/src/shared/services/Dockerfile @supabase/cli @supabase-oss
-/apps/cli-go/pkg/config/templates/Dockerfile @supabase/cli @supabase-oss
 /packages/stack/src/Artifacts.ts @supabase/cli @supabase-oss
-/apps/cli-go/api/v1-openapi.yaml @supabase/cli @supabase-oss
-/apps/cli-go/pkg/api/*.gen.go @supabase/cli @supabase-oss
 /packages/api/src/generated/ @supabase/cli @supabase-oss
 /packages/api/scripts/openapi-source.json @supabase/cli @supabase-oss
 

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -107,7 +107,7 @@ body:
     id: ticket-id
     attributes:
       label: Crash report ID
-      description: If the CLI printed one after rerunning with `--create-ticket`, paste the crash report ID.
+      description: If you have a crash report or support ticket ID, paste it here.
       placeholder: ab1ac733e31e4f928a4d7c8402543712
     validations:
       required: false

.github/actions/setup/action.yml

@@ -14,16 +14,10 @@ inputs:
       fails with a path validation error.
     required: false
     default: "true"
-  go-cache:
-    description: >-
-      Whether to restore the Go module and build caches. Disable this in jobs
-      that never run Go.
-    required: false
-    default: "true"
   tools:
     description: >-
       Space-separated mise tools to install instead of every tool in
-      mise.toml. Skipping the Go toolchain keeps the restored mise cache small.
+      mise.toml.
     required: false
     default: ""
   pnpm-store-cache:
@@ -126,11 +120,10 @@ runs:
         commit: ${{ steps.sticky.outputs.commit }}
 
     - name: Install toolchains
-      uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+      uses: jdx/mise-action@8418fedb1110381a0d3ba51a7a415d7c1b884550 # v5.2.2
       with:
-        version: 2026.9.0
+        version: 2026.10.17
         install_args: ${{ inputs.tools }}
-        cache_key: ${{ inputs.tools != '' && format('mise-{0}-{1}-{2}-{3}', runner.os, runner.arch, inputs.tools, hashFiles('mise.toml', 'mise.lock', '.node-version', '.bun-version', 'package.json')) || '' }}
 
     - name: Resolve pnpm store path
       if: inputs.dependency-cache == 'true'
@@ -189,41 +182,6 @@ runs:
         path: ${{ steps.pnpm-cache.outputs.path }}/lockfile-verified.jsonl
         key: pnpm-verify-${{ runner.os }}-${{ inputs.dependency-firewall-token != '' && 'firewall' || 'public' }}-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml') }}
 
-    - name: Resolve Go cache paths
-      if: inputs.dependency-cache == 'true' && inputs.go-cache == 'true'
-      id: go-cache
-      shell: bash
-      run: |
-        echo "mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
-        echo "build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
-
-    - name: Mount Go module disk
-      if: inputs.dependency-cache == 'true' && inputs.go-cache == 'true' && steps.sticky.outputs.enabled == 'true'
-      uses: useblacksmith/stickydisk@b6cb58d1d31d6d32a25248fab12493d831f7bd48 # v1.7.2
-      with:
-        key: ${{ github.repository }}-go-mod-v3-${{ runner.arch }}
-        path: ${{ steps.go-cache.outputs.mod }}
-        commit: ${{ steps.sticky.outputs.commit }}
-
-    - name: Mount Go build disk
-      if: inputs.dependency-cache == 'true' && inputs.go-cache == 'true' && steps.sticky.outputs.enabled == 'true'
-      uses: useblacksmith/stickydisk@b6cb58d1d31d6d32a25248fab12493d831f7bd48 # v1.7.2
-      with:
-        key: ${{ github.repository }}-go-build-v3-${{ runner.arch }}
-        path: ${{ steps.go-cache.outputs.build }}
-        commit: ${{ steps.sticky.outputs.commit }}
-
-    - name: Configure Go dependency cache
-      if: inputs.dependency-cache == 'true' && inputs.go-cache == 'true' && steps.sticky.outputs.enabled != 'true'
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: |
-          ${{ steps.go-cache.outputs.mod }}
-          ${{ steps.go-cache.outputs.build }}
-        key: go-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('apps/cli-go/go.mod', 'apps/cli-go/go.sum') }}
-        restore-keys: |
-          go-cache-${{ runner.os }}-${{ runner.arch }}-
-
     - name: Install dependencies
       shell: bash
       env:

.github/dependabot.yml

@@ -37,28 +37,6 @@ updates:
         # — never bundle it into the actions-major group.
     cooldown:
       default-days: 7
-  - package-ecosystem: "gomod"
-    directories:
-      - "/apps/cli-go"
-      - "/apps/cli-go/pkg"
-    schedule:
-      interval: "cron"
-      cronjob: "0 0 * * *"
-    commit-message:
-      prefix: "chore(cli-go): "
-    groups:
-      go-minor:
-        update-types:
-          - minor
-          - patch
-        exclude-patterns:
-          - github.com/compose-spec/compose-go/v2
-    ignore:
-      - dependency-name: "github.com/compose-spec/compose-go/v2"
-      - dependency-name: "github.com/docker/cli"
-      - dependency-name: "github.com/docker/docker"
-    cooldown:
-      default-days: 7
   - package-ecosystem: "npm"
     directory: "/"
     schedule:

.github/jactionlint.yaml

@@ -1,4 +1,7 @@
-require-commit-hash: true # actions, reusable workflows and docker:// must be pinned to a full SHA / @sha256 digest
+rules:
+  missing-timeout: off
+  concurrency-limits: off
+  unpinned-uses: error # actions, reusable workflows and docker:// must be pinned to a full SHA / @sha256 digest
 self-hosted-runner:
   labels:
     - arm-runner
@@ -8,3 +11,8 @@ self-hosted-runner:
     - blacksmith-8vcpu-ubuntu-2404
     - blacksmith-8vcpu-windows-2025
     - blacksmith-32vcpu-ubuntu-2404
+paths:
+  # Other projects' repositories, pulled in as git submodules. CI never checks them out.
+  ".repos/**":
+    ignore:
+      - ".*"

.github/scripts/ai-review/resolve.ts

@@ -12,7 +12,7 @@
  *
  * `resolveDecision` is the pure orchestration function (I/O injected) a test
  * can drive without the network; `main()` wires up the real GitHub I/O,
- * writes `should_run`/`pr_number`/`head_ref`/`trigger` to `$GITHUB_OUTPUT`,
+ * writes `should_run`/`pr_number`/`head_sha`/`trigger` to `$GITHUB_OUTPUT`,
  * and surfaces the skip reason (if any) in `$GITHUB_STEP_SUMMARY`.
  *
  * Run in CI as: `bun .github/scripts/ai-review/resolve.ts`.
@@ -374,7 +374,6 @@ function writeOutputs(result: ResolveResult, prNumber: number): void {
   const entries: Record<string, string> = {
     should_run: String(result.shouldRun),
     pr_number: String(prNumber),
-    head_ref: `refs/pull/${prNumber}/head`,
     head_sha: result.headSha ?? "",
     trigger: result.trigger,
   };

.github/scripts/cli-bench/full-plan.test.ts

@@ -0,0 +1,109 @@
+import { describe, expect, test } from "bun:test";
+import { planFullRun, readManifest, type PlanDeps, type PlanInput } from "./full-plan.ts";
+
+const REPO = "supabase/cli";
+const manifest = readManifest(
+  JSON.stringify({
+    workloads: [
+      { id: "start", runtime: "docker", estimatedSeconds: 400 },
+      { id: "db-reset", runtime: "docker", estimatedSeconds: 400 },
+      { id: "stack-start-native", runtime: "native", estimatedSeconds: 100 },
+    ],
+  }),
+);
+
+const input = (overrides: Partial<PlanInput> = {}): PlanInput => ({
+  event: "workflow_dispatch",
+  workloads: "all",
+  runtime: "both",
+  base: "merge-base",
+  refName: "feature/x",
+  repository: REPO,
+  manifest,
+  ...overrides,
+});
+
+const deps = (overrides: Partial<PlanDeps> = {}): PlanDeps => ({
+  latestRelease: async () => "v3.0.0",
+  openPullRequests: async () => [{ number: 12, headRepoFullName: REPO }],
+  ...overrides,
+});
+
+describe("planFullRun", () => {
+  test("measures everything against the latest stable release on a schedule, with no pull request", async () => {
+    const plan = await planFullRun(
+      input({ event: "schedule", workloads: "", runtime: "", base: "", refName: "develop" }),
+      deps(),
+    );
+
+    expect(plan).toMatchObject({
+      workloads: "all",
+      runtime: "both",
+      baseKind: "release",
+      baseTag: "v3.0.0",
+      prNumber: "",
+      runLightweight: true,
+      runIntegration: true,
+    });
+  });
+
+  test("attaches a merge-base run to the branch's single open pull request", async () => {
+    const plan = await planFullRun(input(), deps());
+
+    expect(plan).toMatchObject({ baseKind: "merge-base", baseTag: "", prNumber: "12" });
+  });
+
+  test.each([
+    ["no open pull request", [] as Array<{ number: number; headRepoFullName: string }>],
+    [
+      "two open pull requests",
+      [
+        { number: 1, headRepoFullName: REPO },
+        { number: 2, headRepoFullName: REPO },
+      ],
+    ],
+    ["a pull request from a fork", [{ number: 3, headRepoFullName: "someone/cli" }]],
+  ])("attaches no pull request when the branch has %s", async (_name, pulls) => {
+    const plan = await planFullRun(input(), deps({ openPullRequests: async () => pulls }));
+
+    expect(plan.prNumber).toBe("");
+  });
+
+  test("leaves the pull request comment alone for a run against a release tag", async () => {
+    const plan = await planFullRun(input({ base: "v3.0.0" }), deps());
+
+    expect(plan).toMatchObject({ baseKind: "release", baseTag: "v3.0.0", prNumber: "" });
+  });
+
+  test.each(["main", "v3", "v3.0.0; rm -rf /", "$(id)", "../v3.0.0"])(
+    "rejects the base %p",
+    async (base) => {
+      await expect(planFullRun(input({ base }), deps())).rejects.toThrow("Unsupported base");
+    },
+  );
+
+  test.each([
+    ["lightweight", { runLightweight: true, runIntegration: false, shards: 0 }],
+    ["integration-heavy", { runLightweight: false, runIntegration: true, shards: 3 }],
+    ["all", { runLightweight: true, runIntegration: true, shards: 3 }],
+  ])("plans shards for workloads=%s", async (workloads, expected) => {
+    const plan = await planFullRun(input({ workloads }), deps());
+
+    expect(plan.runLightweight).toBe(expected.runLightweight);
+    expect(plan.runIntegration).toBe(expected.runIntegration);
+    expect(plan.matrix.include).toHaveLength(expected.shards);
+  });
+
+  test("keeps only the requested runtime's shards", async () => {
+    const plan = await planFullRun(input({ runtime: "native" }), deps());
+
+    expect(plan.matrix.include).toEqual([
+      expect.objectContaining({ runtime: "native", workloads: "stack-start-native" }),
+    ]);
+  });
+
+  test("rejects an unknown runtime or workloads choice", async () => {
+    await expect(planFullRun(input({ runtime: "podman" }), deps())).rejects.toThrow("runtime");
+    await expect(planFullRun(input({ workloads: "none" }), deps())).rejects.toThrow("workloads");
+  });
+});