chore: production deploy

.bun-version

@@ -1 +1 @@
-1.3.13
+1.4.0

.github/MAINTAINERS.md

@@ -11,7 +11,7 @@ that carries the **`open-for-contribution`** label. This is enforced by the
 lives in [`scripts/contribution-gate.ts`](./scripts/contribution-gate.ts).
 
 The gate runs **reactively on each PR** so a non-conforming PR is closed right away, and
-can also be **swept across every open PR on demand** via the workflow's *Run workflow*
+can also be **swept across every open PR on demand** via the workflow's _Run workflow_
 button.
 
 A pull request is **auto-closed with an explanatory comment** when the author is external
@@ -48,6 +48,29 @@ function; create it once from **Issues → Labels** if it is missing.
 Applying `open-for-contribution` is currently a **manual step** — do it on the GitHub
 issue directly (from the GitHub UI, or from the Linear-linked issue).
 
+## `run-ci`: full develop CI on stacked or draft PRs
+
+Ready (non-draft) PRs targeting `develop` already get the default suite: Test
+(check / unit+integration / e2e), preview CLI packages, and PR-title lint.
+
+Stacked PRs (base is another PR branch) and drafts do **not** get that suite
+unless they carry the **`run-ci`** label. [`run-ci.yml`](./workflows/run-ci.yml)
+then calls Test and preview-package publish as reusable workflows, including
+while the PR is still a draft.
+
+- Add `run-ci` to start (or resume) the suite; remove it to cancel in-progress
+  `run-ci` runs via that workflow's concurrency group.
+- Other labels do not start or cancel Test / preview. PR-title lint may
+  retrigger because that check is cheap.
+- After a stacked PR is retargeted onto `develop`, push or reopen so the
+  native required checks (`Check code quality`, etc.) populate. The opt-in
+  suite uses different check names (`Test / Check code quality`).
+- This is independent of `run-live-e2e-ci`, which opts into the separate
+  supabox live e2e dispatch.
+
+The `run-ci` label must exist as a repository label; create it from
+**Issues → Labels** if it is missing.
+
 ## Deferred: automatic Linear → GitHub label sync
 
 We considered auto-applying `open-for-contribution` when a Linear issue moves out of

.github/actionlint.yaml

@@ -2,6 +2,7 @@ self-hosted-runner:
   labels:
     - arm-runner
     - blacksmith-2vcpu-ubuntu-2404
+    - blacksmith-4vcpu-ubuntu-2404
     - blacksmith-32vcpu-ubuntu-2404
     - blacksmith-8vcpu-ubuntu-2404
     - blacksmith-6vcpu-macos-latest

.github/dependabot.yml

@@ -42,6 +42,10 @@ updates:
     schedule:
       interval: "cron"
       cronjob: "0 0 * * *"
+    commit-message:
+      prefix: "fix"
+      prefix-development: "chore"
+      include: "scope"
     groups:
       npm-major:
         patterns:

.github/workflows/api-package-sync.yml

@@ -29,7 +29,7 @@ jobs:
           SUPABASE_API_URL: https://api.supabase.com
 
       - name: Format API package
-        run: pnpm exec nx run @supabase/api:fmt:fix
+        run: pnpm exec nx run @supabase/root:fmt:fix
 
       - name: Check for generated changes
         id: check

.github/workflows/cli-go-ci.yml

@@ -91,7 +91,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4
         with:
           version: 2026.7.0
           install: true

.github/workflows/cli-go-codeql.yml

@@ -67,7 +67,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -95,7 +95,7 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           category: "/language:${{matrix.language}}"
 defaults:

.github/workflows/cli-go-mirror-image.yml

@@ -46,7 +46,7 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
       - name: Mirror image
         env:
           SOURCE_IMAGE: docker.io/${{ github.event.client_payload.image || inputs.image }}

.github/workflows/cli-go-pg-prove.yml

@@ -11,7 +11,7 @@ jobs:
     outputs:
       image_tag: supabase/pg_prove:${{ steps.version.outputs.pg_prove }}
     steps:
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
       - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           load: true
@@ -32,7 +32,7 @@ jobs:
     strategy:
       matrix:
         include:
-          - runner: [ self-hosted, X64 ]
+          - runner: [self-hosted, X64]
             arch: amd64
           - runner: arm-runner
             arch: arm64
@@ -42,7 +42,7 @@ jobs:
       image_digest: ${{ steps.build.outputs.digest }}
     steps:
       - run: docker context create builders
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
         with:
           endpoint: builders
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
@@ -66,7 +66,7 @@ jobs:
       - build_image
     runs-on: ubuntu-latest
     steps:
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}

.github/workflows/cli-go-publish-migra.yml

@@ -11,7 +11,7 @@ jobs:
     outputs:
       image_tag: supabase/migra:${{ steps.version.outputs.migra }}
     steps:
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
       - uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           load: true
@@ -32,7 +32,7 @@ jobs:
     strategy:
       matrix:
         include:
-          - runner: [ self-hosted, X64 ]
+          - runner: [self-hosted, X64]
             arch: amd64
           - runner: arm-runner
             arch: arm64
@@ -42,7 +42,7 @@ jobs:
       image_digest: ${{ steps.build.outputs.digest }}
     steps:
       - run: docker context create builders
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
         with:
           endpoint: builders
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
@@ -66,7 +66,7 @@ jobs:
       - build_image
     runs-on: ubuntu-latest
     steps:
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
       - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}

.github/workflows/contribution-gate.yml

@@ -44,7 +44,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: "1.3.13"
+          bun-version-file: ".bun-version"
       - name: Evaluate contribution gate
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -65,7 +65,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
-          bun-version: "1.3.13"
+          bun-version-file: ".bun-version"
       - name: Evaluate contribution gate across all open PRs
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/dispatch-cli-e2e-ci.yml

@@ -3,10 +3,11 @@ name: Dispatch cli-e2e-ci
 # Asks the supabase/cli-e2e-ci harness to run the cli `test:live` suite against
 # a full supabox stack, built from THIS PR's head commit (CLI-1825 / CLI-1831).
 #
-# This is distinct from `live-e2e.yml`, which runs the cli-e2e package against
-# real staging (api.supabase.green). Here the suite runs against a local supabox
-# stack stood up inside the private cli-e2e-ci repo; we only fire the trigger and
-# pass our head SHA — cli-e2e-ci checks that SHA out into its `cli` submodule.
+# This is distinct from `live-e2e.yml`, which runs the collocated live suite
+# against managed staging (api.supabase.green). Here the same `apps/cli` suite
+# runs against a local Supabox stack stood up inside the private cli-e2e-ci repo;
+# we only fire the trigger and pass our head SHA — cli-e2e-ci checks that SHA out
+# into its `cli` submodule.
 #
 # Opt-in by label to keep the expensive full-stack run off every PR: add the
 # `run-live-e2e-ci` label (re-dispatches on each subsequent push while labeled).

.github/workflows/lint-pull-request.yml

@@ -2,6 +2,10 @@ name: Lint Pull Request
 
 # Release-notes PRs (head ref `release-notes/*`) skip CI; only
 # apply-release-notes.yml runs for those.
+#
+# Draft PRs skip this check unless they carry `run-ci` (same opt-in as Test
+# and preview packages). Label events retrigger this cheap check so adding
+# `run-ci` on a draft starts lint without waiting for a push.
 on:
   pull_request_target:
     types:
@@ -10,6 +14,8 @@ on:
       - synchronize
       - reopened
       - ready_for_review
+      - labeled
+      - unlabeled
   merge_group:
     types:
       - checks_requested
@@ -29,7 +35,8 @@ jobs:
       github.event_name == 'merge_group' ||
       (github.event_name == 'pull_request_target' &&
         !startsWith(github.event.pull_request.head.ref, 'release-notes/') &&
-        github.event.pull_request.draft == false)
+        (github.event.pull_request.draft == false ||
+          contains(github.event.pull_request.labels.*.name, 'run-ci')))
     name: Lint Pull Request
     runs-on: ubuntu-latest
     steps:

.github/workflows/live-e2e.yml

@@ -1,7 +1,7 @@
 name: Live E2E
 
-# Live e2e suite (ADR-0013). Runs the real CLI against the real staging
-# Management API + Docker bundler, then invokes the deployed functions over HTTP.
+# Live e2e suite. Runs the collocated `apps/cli` tests against the real staging
+# Management API + Docker bundler, then invokes deployed functions over HTTP.
 #
 # Non-blocking by construction: this is a standalone workflow, NOT part of the
 # required-checks set, and it never runs on the default PR path of test.yml.
@@ -99,10 +99,8 @@ jobs:
     # Non-secret config is job-level; the staging token is scoped to only the two
     # steps that need it (run + cleanup) so build/checkout/docker never see it.
     env:
-      CLI_E2E_MODE: live
-      CLI_E2E_TARGET_ENV: staging
-      CLI_E2E_API_URL: https://api.supabase.green
-      CLI_E2E_PROJECT_HOST: supabase.red
+      SUPABASE_LIVE_API_URL: https://api.supabase.green
+      SUPABASE_LIVE_PROJECT_NAME: supabase-cli-live-${{ matrix.target }}
       CLI_HARNESS_TARGET: ${{ matrix.target }}
     steps:
       - name: Checkout
@@ -131,34 +129,19 @@ jobs:
       - name: Docker preflight
         run: docker info
 
-      - name: Run live e2e (retry up to 3x)
+      - name: Run live e2e
+        timeout-minutes: 20
         env:
           SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_E2E_CLI_LIVE_STAGING_ACCESS_TOKEN }}
-        run: |
-          PREFIX="cli-e2e-live-${CLI_HARNESS_TARGET}-${GITHUB_RUN_ID}-"
-          # GitHub runs this step as `bash -e`; use `if cmd; then` (errexit-exempt)
-          # so a failing attempt does not abort the step before the retry.
-          for attempt in 1 2 3; do
-            echo "::group::live e2e attempt ${attempt}"
-            if [ "$attempt" -gt 1 ]; then
-              bash .github/scripts/sweep-live-projects.sh "$PREFIX" || true
-            fi
-            if pnpm --filter @supabase/cli-e2e test:e2e:live; then
-              echo "::endgroup::"
-              exit 0
-            fi
-            echo "::endgroup::"
-            echo "attempt ${attempt} failed"
-          done
-          exit 1
+        run: pnpm --filter supabase test:live
 
       # Backstop: delete any project this job created that survived a crash.
       # The script exits non-zero (failing this step) if any delete failed.
       - name: Cleanup leftover projects
         if: always()
         env:
           SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_E2E_CLI_LIVE_STAGING_ACCESS_TOKEN }}
-        run: bash .github/scripts/sweep-live-projects.sh "cli-e2e-live-${CLI_HARNESS_TARGET}-${GITHUB_RUN_ID}-"
+        run: bash apps/cli/scripts/sweep-live-projects.sh "supabase-cli-live-${CLI_HARNESS_TARGET}-${GITHUB_RUN_ID}-"
 
   # Record that this beta tested green so the next scheduled run skips it. Needs
   # the whole matrix: the marker is saved only if the ts-legacy leg passed (a

.github/workflows/publish-preview-cli-packages.yml

@@ -2,29 +2,45 @@ name: Publish Preview CLI Packages
 
 # Release-notes PRs (head ref `release-notes/*`) are markdown-only and are not
 # meant to produce installable preview packages.
+#
+# Default path: ready (non-draft) PRs targeting `develop`.
+# `run-ci.yml` calls this workflow for drafts and stacked / non-develop PRs.
 on:
   pull_request:
     types:
       - opened
       - synchronize
       - reopened
       - ready_for_review
+      - converted_to_draft
     branches:
       - develop
+  workflow_call:
+    inputs:
+      force:
+        description: Publish even when the PR is a draft (used by run-ci.yml)
+        type: boolean
+        default: false
+    secrets:
+      DF_FIREWALL_TOKEN:
+        required: true
 
 permissions:
   actions: read
   contents: read
 
+# Literal prefix: called workflows inherit github.workflow from the caller
+# (`run-ci`). `inputs.force` separates this call from a skipped native run on
+# a develop draft.
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref }}
+  group: publish-preview-cli-packages.yml-${{ github.event.pull_request.number || github.head_ref }}-${{ inputs.force && 'run-ci' || 'direct' }}
   cancel-in-progress: true
 
 jobs:
   build:
     if: |
       !startsWith(github.head_ref, 'release-notes/') &&
-      github.event.pull_request.draft == false
+      (inputs.force || github.event.pull_request.draft == false)
     name: Build preview CLI packages
     uses: ./.github/workflows/build-cli-artifacts.yml
     with:
@@ -37,7 +53,7 @@ jobs:
     needs: build
     if: |
       !startsWith(github.head_ref, 'release-notes/') &&
-      github.event.pull_request.draft == false &&
+      (inputs.force || github.event.pull_request.draft == false) &&
       needs.build.result == 'success'
     name: Publish preview package
     runs-on: blacksmith-8vcpu-ubuntu-2404
@@ -121,7 +137,7 @@ jobs:
     needs: publish
     if: |
       !startsWith(github.head_ref, 'release-notes/') &&
-      github.event.pull_request.draft == false &&
+      (inputs.force || github.event.pull_request.draft == false) &&
       needs.publish.result == 'success'
     name: Post preview command comment
     runs-on: ubuntu-latest