ci(actions): bump supabase/setup-cli from 1 to 2#144
Conversation
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
✅ Files skipped from review due to trivial changes (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughO PR atualiza dois workflows do GitHub Actions para usar a versão 2 da action ChangesAtualização de Ações do Supabase CLI
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutos Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/delete-orphan-edges.yml:
- Around line 58-60: Substitua as referências flutuantes supabase/setup-cli@v2 e
o campo version: latest por valores imutáveis: troque supabase/setup-cli@v2 pelo
ref completo usando o commit SHA (40 chars) da tag v2 do repo supabase/setup-cli
e substitua version: latest pelo número de versão CLI desejado (por exemplo
2.98.1) obtido do release; isso garante que a step uses:
supabase/setup-cli@<full-sha> e version: <explicit-version> em vez de refs
flutuantes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: b94f03fe-7849-4ca0-964e-56ac72d76018
📒 Files selected for processing (2)
.github/workflows/delete-orphan-edges.yml.github/workflows/deploy-edge-functions.yml
| uses: supabase/setup-cli@v2 | ||
| with: | ||
| version: latest |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
echo "== 1) Detectar refs flutuantes nos workflows =="
rg -n 'supabase/setup-cli@v2|version:\s*latest' .github/workflows
echo
echo "== 2) Resolver commit SHA real da tag v2 =="
REF_JSON="$(gh api repos/supabase/setup-cli/git/ref/tags/v2)"
OBJ_TYPE="$(jq -r '.object.type' <<<"$REF_JSON")"
OBJ_SHA="$(jq -r '.object.sha' <<<"$REF_JSON")"
if [[ "$OBJ_TYPE" == "tag" ]]; then
COMMIT_SHA="$(gh api repos/supabase/setup-cli/git/tags/"$OBJ_SHA" --jq '.object.sha')"
else
COMMIT_SHA="$OBJ_SHA"
fi
echo "commit_sha_v2=$COMMIT_SHA"Repository: adm01-debug/Promo_Gifts
Length of output: 512
🌐 Web query:
GitHub Actions pinning version SHA security best practices
💡 Result:
Best practice: Pin GitHub Actions to a full-length (40-character) commit SHA in every uses: reference, and (where possible) enforce this via the GitHub “allowed actions” policy so workflows fail if an action isn’t pinned. 1) Why pin to commit SHA (not tags/branches) - GitHub security hardening guidance recommends pinning actions to a full-length commit SHA because it makes the action behave like an immutable release; this helps mitigate the risk of a bad actor adding a backdoor to an action repository by changing what a mutable ref points to. [1] - Pinning a short SHA is explicitly insecure; GitHub warns that short SHAs can collide because users can fork and craft commits, and workflows using shortened SHAs will fail. [2] 2) What GitHub expects your workflow to look like - Example pattern from GitHub action versioning guidance: use the long SHA form rather than @vX.Y.Z or @main. [3] - GitHub policy enforcement checks for a “full commit SHA”; if an action isn’t pinned, the workflow fails. [4] 3) How to operationalize it (enforcement) - GitHub’s “allowed actions” policy can enforce SHA pinning. When enabled, workflows that attempt to use an action that isn’t pinned to a full commit SHA will fail. [4] - At the enterprise level, GitHub also documents an option “Require actions to be pinned to a full-length commit SHA” (including GitHub-authored actions). [5] 4) Managing updates without losing security - GitHub recommends pinning to SHAs to prevent malicious code from being automatically used when branches/tags are updated. [4] - Dependabot can be used to update vulnerable actions and can work with SHA-pinned actions; GitHub notes that Dependabot only creates alerts for vulnerable actions that use semantic versioning and will not create alerts for actions pinned to SHA values. [1] - If you want automated updates for SHA pins specifically, you’ll typically use a dedicated workflow/tool approach (e.g., Dependabot/Renovate with support for SHA-pinned updates, or a “ensure SHA pinned actions” job) rather than relying on Dependabot vulnerability alerts alone. (Policy guidance around updating pinned actions is discussed in community-maintenance PRs and tooling, but the core official security recommendation is still the SHA pin + enforcement pattern.) [6][7] 5) Practical security hardening checklist (pinning is one part) - Alongside SHA pinning, GitHub’s security-hardening guidance also covers other controls (e.g., trusting tags only if you trust the creator; auditing action code; and governance via policies). [1] Example: SHA pinning in a workflow - Use: - uses: OWNER/REPO@<FULL_40_CHAR_SHA> # <optional human-readable version> - Avoid: - uses: OWNER/REPO@v4 (mutable to minor/patch updates) - uses: OWNER/REPO@main / @latest (branches/tags can move) If you tell me which actions you currently use (the uses: lines from your workflows), I can help you convert them to full-SHA pins and suggest an enforcement configuration consistent with your org/repo setup.
Citations:
- 1: https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions?learn=getting_started&learnProduct=actions
- 2: https://docs.github.com/enterprise-server@3.0/actions/security-guides/security-hardening-for-github-actions
- 3: https://github.com/actions/toolkit/blob/main/docs/action-versioning.md
- 4: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/
- 5: https://docs.github.com/en/enterprise-cloud@latest/admin/enforcing-policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-github-actions-in-your-enterprise
- 6: Pin all GitHub Actions to immutable SHA commits for supply chain security github/gh-aw#5691
- 7: https://github.com/step-security/github-actions-ensure-sha-pinned-actions
🌐 Web query:
supabase setup-cli latest version stable release
💡 Result:
Latest stable Supabase CLI release (as of 2026-05-11): v2.98.1 (published 2026-05-04). [1] Notes about “setup-cli” (GitHub Action) vs “Supabase CLI version”: - The GitHub Action supabase/setup-cli is a separate project from the Supabase CLI itself; the action accepts a version input and installs that CLI version (or latest if omitted). [2][3] - In the action’s action.yml, if version is omitted it “detect[s] from the root lockfile and otherwise use latest.” [3] How to pin the stable CLI in CI using supabase/setup-cli: - Use the stable CLI version explicitly: - uses: supabase/setup-cli@v2 - with: { version: "2.98.1" } [2][3] - Or let the action install the default latest (not necessarily “stable” if you later switch to a prerelease-aware workflow): - with: { version: "latest" } [2] Sources: [1] https://github.com/supabase/cli/releases [2] https://github.com/supabase/setup-cli/releases [3] https://github.com/supabase/setup-cli/blob/main/action.yml
Citations:
- 1: https://github.com/supabase/setup-cli/releases
- 2: https://github.com/supabase/setup-cli
- 3: https://supabase.com/docs/guides/cli/getting-started
🏁 Script executed:
#!/bin/bash
# Verificar contexto do workflow: o que exatamente faz, e se há outros lugares com mesmo padrão
echo "== Contexto do workflow delete-orphan-edges.yml =="
head -n 20 .github/workflows/delete-orphan-edges.yml
echo
echo "== Ocorrências de `@v2` em todo o repo =="
rg '@v2' --type yaml
echo
echo "== Ocorrências de version: latest em workflows =="
rg 'version:\s*latest' --type yamlRepository: adm01-debug/Promo_Gifts
Length of output: 1085
Pin a action e versão explícita da CLI para evitar regressões não-determinísticas no CI.
Em linha 58 e linha 60: @v2 e version: latest são refs flutuantes. Isso causa risco de breaking changes silenciosas quando a tag v2 aponta para um novo commit (sem seu controle) ou quando o binário CLI é atualizado.
O workflow executa com SUPABASE_ACCESS_TOKEN, logo uma regressão aqui pode deletar edge functions inesperadas. Use:
- uses: supabase/setup-cli@v2
+ uses: supabase/setup-cli@<COMMIT_SHA_COMPLETO_DA_TAG_v2>
with:
- version: latest
+ version: 2.98.1Resolva o SHA completo (40 chars) da tag v2 no repositório supabase/setup-cli via GitHub UI ou CLI (gh api repos/supabase/setup-cli/commits/v2), e substitua 2.98.1 pela versão atual do CLI desejada. Isso garante reprodutibilidade entre execuções e bloqueia supply-chain drift.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/delete-orphan-edges.yml around lines 58 - 60, Substitua as
referências flutuantes supabase/setup-cli@v2 e o campo version: latest por
valores imutáveis: troque supabase/setup-cli@v2 pelo ref completo usando o
commit SHA (40 chars) da tag v2 do repo supabase/setup-cli e substitua version:
latest pelo número de versão CLI desejado (por exemplo 2.98.1) obtido do
release; isso garante que a step uses: supabase/setup-cli@<full-sha> e version:
<explicit-version> em vez de refs flutuantes.
|
@dependabot rebase (Edge Functions Deno typecheck falhou na execução anterior por 522 Bad Gateway no esm.sh — falha transitória de CDN externo, não relacionada com o upgrade da CLI. Re-executando.) |
Bumps [supabase/setup-cli](https://github.com/supabase/setup-cli) from 1 to 2. - [Release notes](https://github.com/supabase/setup-cli/releases) - [Commits](supabase/setup-cli@v1...v2) --- updated-dependencies: - dependency-name: supabase/setup-cli dependency-version: '2' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/supabase/setup-cli-2
branch
from
0b989ab to
614ec14
Compare
Tarefa 7 do redeploy. Triagei 7 PRs dependabot abertas há semanas. Resultado: - 4 mergeadas: #138, #139, #144, #145 (devtools + CI actions, baixo risco) - 3 fechadas: #140, #141, #142 (runtime majors com breaking changes) - 1 issue criada: #155 (tracking dos 3 majors pendentes) Critério: triagem por RISCO REAL (devtools vs runtime), não por minor/major. Decisões persistidas em docs/redeploy/REDEPLOY-T7-DEPENDABOT.md: - Lista completa das 7 PRs com decisão e razão - Critérios de triagem reutilizáveis - Achados sobre falsos-positivos (CDN 522 do esm.sh) - Recomendação de dependabot.yml para reduzir ruído futuro - Status atualizado do plano de redeploy Closes part of #155 (T7 do plano) Co-authored-by: Joaquim (via Claude Code redeploy T2) <joaquim@atomicabr.com.br> Co-authored-by: Claude <noreply@anthropic.com>
1 participant
Bumps supabase/setup-cli from 1 to 2.
Release notes
Sourced from supabase/setup-cli's releases.
... (truncated)
Commits
df56b21chore(deps-dev): bump the bun-minor-patch group with 2 updates (#419)6c93bdechore(deps-dev): bump@types/bunfrom 1.3.11 to 1.3.12 in the bun-minor-patch...7fcab5bchore(deps-dev): bump@typescript/native-previewfrom 7.0.0-dev.20260409.1 to...6081904[codex] fix dependabot actions cooldown config (#414)c099ad8fix: auto-approval and refine dependabot policy (#412)afb0a59fix: await main function (#411)7fef86cfix: licensed workflow trigger (#413)337fb0dchore(deps-dev): bump@typescript/native-previewfrom 7.0.0-dev.20260401.1 to...33d1b57chore(deps-dev): bump the bun-development group with 3 updates (#408)24d47d8chore(deps): bump ruby/setup-ruby from 1.299.0 to 1.300.0 in the actions-mino...Summary by CodeRabbit
Release Notes