supabase-cli-releaser · Nov 9, 2026 · Nov 9, 2026 · Nov 9, 2026 · Nov 9, 2026 · Nov 10, 2026
@@ -38,6 +38,10 @@ on:
         required: false
         type: string
         default: supabase
+    outputs:
+      setup_cli_npm_fallback:
+        description: "'true' when a setup-cli v3 smoke job installed from the GitHub release because the npm install failed"
+        value: ${{ jobs.setup-cli-smoke.outputs.npm_fallback }}
     secrets:
       SENTRY_DSN:
         required: false

@@ -473,6 +473,28 @@ jobs:
       status: success
       version: ${{ needs.plan.outputs.version }}
       channel: ${{ needs.plan.outputs.channel }}
+      setup_cli_npm_fallback: ${{ needs.release.outputs.setup_cli_npm_fallback == 'true' }}
+    secrets:
+      SLACK_RELEASE_WEBHOOK: ${{ secrets.SLACK_RELEASE_WEBHOOK }}
+
+  # notify-slack posts no success message for beta and next, so a setup-cli npm fallback on those
+  # channels gets a notice of its own.
+  notify-slack-npm-fallback:
+    name: Notify Slack (setup-cli npm fallback)
+    needs: [plan, release]
+    if: >-
+      ${{ !cancelled() &&
+      needs.release.result == 'success' &&
+      needs.plan.outputs.dry_run != 'true' &&
+      needs.release.outputs.setup_cli_npm_fallback == 'true' &&
+      needs.plan.outputs.channel != 'stable' &&
+      needs.plan.outputs.channel != 'maintenance' }}
+    uses: ./.github/workflows/slack-notify.yml
+    with:
+      package: Supabase CLI
+      status: setup-cli-npm-fallback
+      version: ${{ needs.plan.outputs.version }}
+      channel: ${{ needs.plan.outputs.channel }}
     secrets:
       SLACK_RELEASE_WEBHOOK: ${{ secrets.SLACK_RELEASE_WEBHOOK }}
 

@@ -5,7 +5,7 @@ name: setup-cli Smoke Test
 # workflow_dispatch when debugging setup-cli regressions. Catches regressions like
 # supabase/setup-cli#427, where musl libc + archive layout changes silently broke the action on
 # Alpine. v3 installs from npm: each v3 runner first waits until npm serves the version, and the
-# job fails if setup-cli fell back to the GitHub release. A separate job forces that fallback.
+# job warns if setup-cli fell back to the GitHub release. A separate job forces that fallback.
 
 on:
   workflow_call:
@@ -14,6 +14,10 @@ on:
         description: Supabase CLI version to install via setup-cli (must already be published to GitHub Releases and npm)
         required: true
         type: string
+    outputs:
+      npm_fallback:
+        description: "'true' when any v3 job installed from the GitHub release because the npm install failed"
+        value: ${{ jobs.summary.outputs.npm_fallback }}
   workflow_dispatch:
     inputs:
       version:
@@ -89,17 +93,27 @@ jobs:
             echo "Version mismatch: expected ${expected}, got ${actual}" >&2
             exit 1
           fi
-      - name: Verify setup-cli installed from npm
+      - name: Warn if setup-cli fell back from npm
+        id: npm-source
         if: matrix.major-version == 'v3'
         shell: bash
         env:
           INSTALL_SOURCE: ${{ steps.setup-cli-v3.outputs.install-source }}
         run: |
           set -euo pipefail
           if [ "${INSTALL_SOURCE}" != "npm" ]; then
-            echo "::error::setup-cli fell back to ${INSTALL_SOURCE} because installing supabase@${VERSION#v} from npm failed; check the setup-cli step log"
-            exit 1
+            echo "::warning::setup-cli fell back to ${INSTALL_SOURCE} because installing supabase@${VERSION#v} from npm failed; check the setup-cli step log"
+            echo "${INSTALL_SOURCE}" > npm-fallback.txt
+            echo "fallback=true" >> "$GITHUB_OUTPUT"
           fi
+      - name: Record the npm fallback
+        if: steps.npm-source.outputs.fallback == 'true'
+        # Best-effort: a failed upload must not fail the release; the warning above still annotates the run.
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: npm-fallback-v3-${{ matrix.runner }}
+          path: npm-fallback.txt
 
   # A separate job because GitHub Actions only honours `container:` on Linux runners, and mixing
   # container + non-container entries in one matrix is fragile when the value is empty. The
@@ -172,17 +186,27 @@ jobs:
             echo "Version mismatch: expected ${expected}, got ${actual}" >&2
             exit 1
           fi
-      - name: Verify setup-cli installed from npm
+      - name: Warn if setup-cli fell back from npm
+        id: npm-source
         if: matrix.major-version == 'v3'
         shell: bash
         env:
           INSTALL_SOURCE: ${{ steps.setup-cli-v3.outputs.install-source }}
         run: |
           set -euo pipefail
           if [ "${INSTALL_SOURCE}" != "npm" ]; then
-            echo "::error::setup-cli fell back to ${INSTALL_SOURCE} because installing supabase@${VERSION#v} from npm failed; check the setup-cli step log"
-            exit 1
+            echo "::warning::setup-cli fell back to ${INSTALL_SOURCE} because installing supabase@${VERSION#v} from npm failed; check the setup-cli step log"
+            echo "${INSTALL_SOURCE}" > npm-fallback.txt
+            echo "fallback=true" >> "$GITHUB_OUTPUT"
           fi
+      - name: Record the npm fallback
+        if: steps.npm-source.outputs.fallback == 'true'
+        # Best-effort: a failed upload must not fail the release; the warning above still annotates the run.
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: npm-fallback-v3-alpine
+          path: npm-fallback.txt
 
   setup-cli-smoke-test-github-release:
     name: setup-cli v3 GitHub release fallback (ubuntu-latest)
@@ -222,3 +246,30 @@ jobs:
             echo "::error::setup-cli installed from ${INSTALL_SOURCE} instead of falling back to the GitHub release with npm disabled"
             exit 1
           fi
+
+  summary:
+    name: setup-cli npm fallback summary
+    needs: [setup-cli-smoke-test, setup-cli-smoke-test-alpine]
+    if: ${{ always() }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    permissions:
+      actions: read
+    outputs:
+      npm_fallback: ${{ steps.fallbacks.outputs.npm_fallback }}
+    steps:
+      - id: fallbacks
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          RUN_ID: ${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          # Never exits nonzero: failing here would fail the release.
+          if ! names="$(gh api --paginate "repos/${REPO}/actions/runs/${RUN_ID}/artifacts" --jq '.artifacts[].name')"; then
+            echo "::warning::Could not list this run's artifacts, so the setup-cli npm fallback check did not run; check the setup-cli v3 smoke jobs for a fallback warning"
+            exit 0
+          fi
+          count="$(grep -c '^npm-fallback-' <<< "${names}" || true)"
+          echo "npm_fallback=$([ "${count}" -gt 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
@@ -18,7 +18,7 @@ on:
         type: string
         default: ""
       status:
-        description: Notification kind (success | failure | publish-failure | awaiting-approval | declined | sync-conflict)
+        description: Notification kind (success | failure | publish-failure | setup-cli-npm-fallback | awaiting-approval | declined | sync-conflict)
         required: false
         type: string
         default: success
@@ -37,6 +37,11 @@ on:
         required: false
         type: string
         default: ""
+      setup_cli_npm_fallback:
+        description: Whether the setup-cli smoke test fell back from npm to the GitHub release. Adds a notice to success messages.
+        required: false
+        type: boolean
+        default: false
     secrets:
       SLACK_RELEASE_WEBHOOK:
         required: true
@@ -58,6 +63,7 @@ jobs:
           TAG_PREFIX: ${{ inputs.tag_prefix }}
           NPM_PACKAGE: ${{ inputs.npm_package }}
           PULL_REQUEST: ${{ inputs.pull_request }}
+          SETUP_CLI_NPM_FALLBACK: ${{ inputs.setup_cli_npm_fallback }}
           REPO: ${{ github.repository }}
           RUN_ID: ${{ github.run_id }}
           SHA: ${{ github.sha }}
@@ -86,6 +92,9 @@ jobs:
               if [[ -n "$NPM_PACKAGE" ]]; then
                 DETAILS="*npm:* <https://www.npmjs.com/package/${NPM_PACKAGE}/v/${VERSION}|${NPM_PACKAGE}@${VERSION}>\n${DETAILS}"
               fi
+              if [[ "$SETUP_CLI_NPM_FALLBACK" == "true" ]]; then
+                DETAILS="⚠️ *setup-cli smoke test:* installing from npm failed and setup-cli fell back to the GitHub release. See the setup-cli smoke jobs in the workflow run.\n${DETAILS}"
+              fi
               ;;
             failure)
               # version/channel may be empty when the planning job itself failed, so
@@ -110,6 +119,11 @@ jobs:
               FALLBACK_TEXT="⚠️ ${PACKAGE} v${VERSION} was released, but publishing to supabase.com failed"
               DETAILS="The CLI reference or config schemas pull request in supabase/supabase was not opened or updated. Rerun the *Publish to supabase.com* job.\n*Version:* v${VERSION}\n*Commit:* <${COMMIT_URL}|${SHORT_SHA}>\n*Workflow run:* <${RUN_URL}|view failed run>"
               ;;
+            setup-cli-npm-fallback)
+              HEADER="⚠️ ${PACKAGE} v${VERSION} released, but setup-cli fell back from npm"
+              FALLBACK_TEXT="⚠️ ${PACKAGE} v${VERSION} was released, but setup-cli fell back from npm to the GitHub release"
+              DETAILS="Installing from npm failed in the setup-cli smoke test and setup-cli fell back to the GitHub release. See the setup-cli smoke jobs in the workflow run.\n*Version:* v${VERSION}\n*Commit:* <${COMMIT_URL}|${SHORT_SHA}>\n*Workflow run:* <${RUN_URL}|view run>"
+              ;;
             awaiting-approval)
               # The approval itself happens on the workflow run page (Approve button +
               # the plan job's evidence summary) — an incoming webhook is one-way and

@@ -211,6 +211,7 @@
     "saml_enabled": false,
     "saml_external_url": null,
     "security_sb_forwarded_for_enabled": false,
+    "external_email_magic_link_disabled": false,
     "security_captcha_enabled": false,
     "security_captcha_provider": "hcaptcha",
     "security_captcha_secret": null,

@@ -211,6 +211,7 @@
     "saml_enabled": false,
     "saml_external_url": null,
     "security_sb_forwarded_for_enabled": false,
+    "external_email_magic_link_disabled": false,
     "security_captcha_enabled": false,
     "security_captcha_provider": "hcaptcha",
     "security_captcha_secret": null,

@@ -211,6 +211,7 @@
     "saml_enabled": false,
     "saml_external_url": null,
     "security_sb_forwarded_for_enabled": false,
+    "external_email_magic_link_disabled": false,
     "security_captcha_enabled": false,
     "security_captcha_provider": "hcaptcha",
     "security_captcha_secret": null,

@@ -249,6 +249,7 @@
           "saml_enabled": false,
           "saml_external_url": null,
           "security_sb_forwarded_for_enabled": false,
+          "external_email_magic_link_disabled": false,
           "security_captcha_enabled": false,
           "security_captcha_provider": "hcaptcha",
           "security_captcha_secret": null,

@@ -211,6 +211,7 @@
     "saml_enabled": false,
     "saml_external_url": null,
     "security_sb_forwarded_for_enabled": false,
+    "external_email_magic_link_disabled": false,
     "security_captcha_enabled": false,
     "security_captcha_provider": null,
     "security_captcha_secret": null,

@@ -1006,6 +1006,7 @@
               "saml_enabled": false,
               "saml_external_url": null,
               "security_sb_forwarded_for_enabled": false,
+              "external_email_magic_link_disabled": false,
               "security_captcha_enabled": false,
               "security_captcha_provider": "hcaptcha",
               "security_captcha_secret": null,

@@ -1006,6 +1006,7 @@
               "saml_enabled": false,
               "saml_external_url": null,
               "security_sb_forwarded_for_enabled": false,
+              "external_email_magic_link_disabled": false,
               "security_captcha_enabled": false,
               "security_captcha_provider": "hcaptcha",
               "security_captcha_secret": null,

@@ -526,6 +526,7 @@
         "saml_enabled": false,
         "saml_external_url": null,
         "security_sb_forwarded_for_enabled": false,
+        "external_email_magic_link_disabled": false,
         "security_captcha_enabled": false,
         "security_captcha_provider": "hcaptcha",
         "security_captcha_secret": null,

@@ -229,9 +229,12 @@ text layer. Therefore stdout is payload-only for either machine flag. Do not cha
 layer to move spinners; that would change text output globally. Handlers check `--output` first and
 use established encoders before the `output.format` branch.
 
-Plan-gated denials carry an optional `entitlement: { feature, upgrade_url }` on the json and
-stream-json error object. `mapHttpError` attaches it from the Management API's
-`entitlement_required` body, so a handler that rebuilds a mapped status error must forward it.
+Plan-gated denials carry an optional `entitlement: { feature, upgrade_url }` on the error.
+`mapHttpError` attaches it from the Management API's `entitlement_required` body. The json and
+stream-json error object carries it, the text layer's `fail` prints the upgrade hint from it, and
+`withCommandTelemetry` fires `cli_upgrade_suggested` from it, so a handler that rebuilds a mapped
+status error must forward it. `suggestUpgrade` prints and fires only on its entitlements-lookup
+fallback.
 
 ## Targets and hosted consent
 

@@ -4,6 +4,7 @@
     { "id": "help", "args": ["--help"], "cwdSetup": "none" },
     { "id": "init", "args": ["init"], "cwdSetup": "none" },
     { "id": "migration-new", "args": ["migration", "new", "bench"], "cwdSetup": "init" },
+    { "id": "config-convert", "args": ["config", "convert"], "cwdSetup": "init" },
     {
       "id": "gen-types",
       "args": ["gen", "types", "--lang", "typescript", "--project-id", "replayfixtureprojref"],

@@ -68,6 +68,9 @@ It is emitted once per handled command invocation and includes:
 - `exit_code`
 - `duration_ms`
 - `output_format`
+- `config_format` (`toml`, `json` or `jsonc`) once the command reads the project's config file,
+  set on success and on failure, including when the file fails to parse. Commands that never read
+  the project config, and projects without one, omit it
 
 Failed invocations (`exit_code != 0`) handled by the TS shells also carry a
 sanitized error classification:

@@ -534,7 +534,7 @@ Both updaters run automatically from `release-shared.yml`'s `publish-homebrew` a
 
 Once the channels are live, two reusable workflows run automatically (last in `release-shared.yml`, non-gating — by the time they run the artifacts are already published, so a failure surfaces as a red post-release signal rather than blocking distribution):
 
-- `[setup-cli-smoke-test.yml](../../../.github/workflows/setup-cli-smoke-test.yml)` (`setup-cli-smoke` job) — installs the released version through `supabase/setup-cli` v1 and v2 (the GitHub Release download path) and v3 (the npm package) on Linux, macOS, Windows, and Alpine. v3 waits on each runner until npm serves the version (up to 15 minutes) and fails unless setup-cli installed from npm; one ubuntu job forces the GitHub release fallback.
+- `[setup-cli-smoke-test.yml](../../../.github/workflows/setup-cli-smoke-test.yml)` (`setup-cli-smoke` job) — installs the released version through `supabase/setup-cli` v1 and v2 (the GitHub Release download path) and v3 (the npm package) on Linux, macOS, Windows, and Alpine. v3 waits on each runner until npm serves the version (up to 15 minutes) and warns when setup-cli installed from somewhere other than npm, since the GitHub release fallback is a supported path; the fallback is added as a notice to the success Slack message on `stable`/`maintenance` and posted as its own notice on `beta`/`next`, which get no success message; one ubuntu job forces the GitHub release fallback.
 - `[verify-install-channels.yml](../../../.github/workflows/verify-install-channels.yml)` (`verify-install-channels` job) — runs a **real** `brew install` (macOS **and** Linux, so both the `on_macos` and `on_linux` stanzas of the formula are exercised), `scoop install`, and `curl|bash` install of the **published** install script (fetched from the release asset, not the repo checkout) against the just-published Homebrew tap, Scoop bucket, and GitHub Release. Each leg then asserts `supabase --version` matches and runs `supabase --help` to exercise the actual command tree. brew, scoop, and the install script each verify the published `sha256`/`hash` against the downloaded tarball, so this is the signal that would have caught CLI v2.107.0 (where the brew/scoop manifests shipped checksums that did not match the release tarballs and every `brew install` / `scoop install` failed). It only runs for `beta`/`stable`/`maintenance` (the channels that publish brew/scoop) and can be dispatched manually against any already-published version via the Actions tab.
 
 ### Code signing (macOS)