ci: shard package-local test suites

.github/actionlint.yaml

@@ -2,6 +2,7 @@ self-hosted-runner:
   labels:
     - arm-runner
     - blacksmith-2vcpu-ubuntu-2404
+    - blacksmith-4vcpu-ubuntu-2404
     - blacksmith-32vcpu-ubuntu-2404
     - blacksmith-8vcpu-ubuntu-2404
     - blacksmith-6vcpu-macos-latest

.github/workflows/test.yml

@@ -67,13 +67,35 @@ jobs:
       - name: Check code quality
         run: pnpm run check:all
 
-  test-core:
+  test-unit:
     if: |
       !startsWith(github.head_ref, 'release-notes/') &&
       (github.event_name == 'merge_group' ||
         inputs.force ||
         github.event.pull_request.draft == false)
-    name: Run unit and integration tests
+    name: Run unit tests
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Setup
+        uses: ./.github/actions/setup
+        with:
+          dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
+
+      - name: Run unit tests
+        run: pnpm run test:unit --coverage.enabled
+
+  test-integration:
+    if: |
+      !startsWith(github.head_ref, 'release-notes/') &&
+      (github.event_name == 'merge_group' ||
+        inputs.force ||
+        github.event.pull_request.draft == false)
+    name: Run integration tests
     runs-on: blacksmith-8vcpu-ubuntu-2404
     steps:
       - name: Checkout
@@ -85,11 +107,29 @@ jobs:
         uses: ./.github/actions/setup
         with:
           dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
-      - name: Unlock keyring (for cli-go keyring tests)
-        uses: t1m0thyj/unlock-keyring@cbcf205c879ebd86add70bab3a6abfcce59a5cae # v1.2.0
 
-      - name: Run unit and integration tests
-        run: pnpm run test:core
+      - name: Run integration tests
+        run: pnpm run test:integration --coverage.enabled
+
+  test-summary:
+    if: |
+      always() &&
+      !startsWith(github.head_ref, 'release-notes/') &&
+      (github.event_name == 'merge_group' ||
+        inputs.force ||
+        github.event.pull_request.draft == false)
+    name: Run unit and integration tests
+    needs: [test-unit, test-integration]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify unit and integration tests succeeded
+        run: |
+          if [ "${{ needs.test-unit.result }}" = "failure" ] || [ "${{ needs.test-unit.result }}" = "cancelled" ] || \
+            [ "${{ needs.test-integration.result }}" = "failure" ] || [ "${{ needs.test-integration.result }}" = "cancelled" ]; then
+            echo "::error ::Unit or integration tests failed: unit=${{ needs.test-unit.result }}, integration=${{ needs.test-integration.result }}"
+            exit 1
+          fi
+          echo "Unit and integration tests reported: unit=${{ needs.test-unit.result }}, integration=${{ needs.test-integration.result }}"
 
   test-e2e:
     if: |
@@ -109,47 +149,12 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Set base and head SHAs for affected
-        if: github.event.pull_request && !inputs.force
-        uses: nrwl/nx-set-shas@afb73a62d26e41464e9254689e1fd6122ee683c1 # v5.0.1
-
-      # Reusable calls inherit the caller's github context (event_name stays
-      # pull_request). Use the PR payload directly so we do not depend on
-      # nx-set-shas understanding the caller event.
-      - name: Set base and head SHAs for run-ci reusable call
-        if: inputs.force && github.event.pull_request
-        run: |
-          echo "NX_BASE=${{ github.event.pull_request.base.sha }}" >> "$GITHUB_ENV"
-          echo "NX_HEAD=${{ github.event.pull_request.head.sha }}" >> "$GITHUB_ENV"
-
-      - name: Set base and head SHAs for merge queue affected
-        if: github.event_name == 'merge_group'
-        run: |
-          echo "NX_BASE=${{ github.event.merge_group.base_sha }}" >> "$GITHUB_ENV"
-          echo "NX_HEAD=${{ github.event.merge_group.head_sha }}" >> "$GITHUB_ENV"
-
       - name: Setup
         uses: ./.github/actions/setup
         with:
           dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
 
-      # Detect which e2e suites should run. On PR and merge queue runs we
-      # honour `nx affected` using the event-specific base and head SHAs.
-      - name: Detect affected e2e projects
-        id: detect
-        run: |
-          affected=$(pnpm exec nx show projects --affected --withTarget test:e2e --json | jq -r '.[]')
-          echo "Affected e2e projects:"
-          echo "$affected"
-          cli=false
-          other=false
-          if echo "$affected" | grep -qx '@supabase/cli-e2e'; then cli=true; fi
-          if echo "$affected" | grep -vx '@supabase/cli-e2e' | grep -q .; then other=true; fi
-          echo "cli_e2e=$cli" >> "$GITHUB_OUTPUT"
-          echo "other=$other" >> "$GITHUB_OUTPUT"
-
       - name: Cache Go CLI binary
-        if: steps.detect.outputs.cli_e2e == 'true'
         id: cache-go-binary
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
@@ -158,40 +163,23 @@ jobs:
             'apps/cli-go/go.mod', 'apps/cli-go/go.sum') }}
 
       - name: Build Go CLI
-        if: steps.detect.outputs.cli_e2e == 'true' &&
-          steps.cache-go-binary.outputs.cache-hit != 'true'
+        if: steps.cache-go-binary.outputs.cache-hit != 'true'
         run: go build -o supabase-go .
         working-directory: apps/cli-go
 
       # The ts-legacy/ts-next harnesses invoke `node apps/cli/dist/supabase.js`
       # with `SUPABASE_CLI_BINARY_OVERRIDE` pointing at the compiled per-shell
-      # binary in `apps/cli/dist/`. The `nx run @supabase/cli-e2e:test:e2e`
-      # target normally builds the supabase umbrella via `dependsOn`, but we
-      # bypass nx for sharding so we build it explicitly.
+      # binary in `apps/cli/dist/`. Build the CLI explicitly before invoking
+      # every package-local e2e suite.
       - name: Build CLI
-        if: steps.detect.outputs.cli_e2e == 'true'
         run: pnpm exec nx run supabase:build
 
-      # Sharding for cli-e2e (the heavy suite) per
-      # https://vitest.dev/guide/improving-performance.html#sharding.  We invoke
-      # vitest directly because routing `--shard` through `pnpm run / nx run-many
-      # -- --shard=N/3` introduces a stray `--` that vitest treats as a
-      # positional-argument terminator, defeating the shard flag.  Other e2e
-      # suites (process-compose) run unsharded on shard 1.
-      - name: Run cli-e2e end-to-end tests
-        if: steps.detect.outputs.cli_e2e == 'true'
-        run: pnpm --filter @supabase/cli-e2e exec bun --bun vitest run --shard=${{
-          matrix.shard }}/3
+      - name: Run end-to-end tests
+        run: pnpm exec turbo run test:e2e:run --only --concurrency=1 -- --shard=${{ matrix.shard }}/3
         env:
           CLI_HARNESS_TARGET: ts-legacy
           SUPABASE_GO_BINARY: ${{ github.workspace }}/apps/cli-go/supabase-go
 
-      - name: Run other e2e tests (shard 1 only)
-        if: matrix.shard == 1 && steps.detect.outputs.other == 'true'
-        run: pnpm exec nx run-many -t test:e2e --exclude=@supabase/cli-e2e
-        env:
-          SUPABASE_GO_BINARY: ${{ github.workspace }}/apps/cli-go/supabase-go
-
   # Summary job that gates branch protection.  The matrix `test-e2e` job
   # produces per-shard check names (`Run end-to-end tests (shard N/3)`), so
   # this job preserves the original `Run end-to-end tests` check name that

CONTRIBUTING.md

@@ -141,20 +141,19 @@ pnpm run fix:all     # run all fixers across every project
 
 ### Standard package scripts
 
-All standard TypeScript workspaces (`apps/cli`, `packages/api`, `packages/config`, `packages/process-compose`, `packages/stack`) expose the following scripts:
+Standard TypeScript workspaces (`apps/cli`, `packages/api`, `packages/config`, `packages/process-compose`, `packages/stack`) declare their package scripts explicitly. Test suites vary by package: unit tests are standard, while integration and e2e tests exist only where applicable.
 
 | Script             | What it does                                             |
 | ------------------ | -------------------------------------------------------- |
-| `test`             | Run the full test suite (unit + integration + e2e)       |
-| `test:core`        | Run unit and integration tests                           |
-| `test:unit`        | Run unit tests _(inferred by Nx plugin)_                 |
-| `test:integration` | Run integration tests _(inferred by Nx plugin)_          |
-| `test:e2e`         | Run end-to-end tests _(inferred by Nx plugin)_           |
+| `test`             | Run the package's declared test suites                   |
+| `test:unit`        | Run unit tests                                           |
+| `test:integration` | Run integration tests where applicable                   |
+| `test:e2e`         | Run end-to-end tests where applicable                    |
 | `check:all`        | Run all check targets for this project                   |
 | `fix:all`          | Run all fix targets for this project                     |
 | `types:check`      | Type-check with `tsc --noEmit` _(inferred by Nx plugin)_ |
 
-The inferred scripts (`test:unit`, `test:integration`, `test:e2e`, `types:check`) are not declared in `package.json` — they are injected by local Nx plugins in `tools/nx-plugins/`. They are fully cached and can be discovered via `nx show project <name>`.
+The test scripts are declared in each package's `package.json`, so package-local test commands are directly discoverable and can be sharded independently. Type-checking remains an Nx-inferred target.
 
 Linting, formatting, and unused-code analysis are repo-wide rather than per-package: `oxlint`, `oxfmt`, and `knip` read `.oxlintrc.json`, `.oxfmtrc.json`, and `knip.json` at the repo root (knip's config maps each workspace under its `workspaces` key) and run as `lint:*`/`fmt:*`/`knip:*` targets on the `@supabase/root` project (declared in the root `package.json`). Each package's `check:all`/`fix:all` includes them, and running the tools directly also just works:
 
@@ -170,12 +169,23 @@ Quality checks are run from the workspace you are changing:
 # From a project directory — scoped to that project only:
 pnpm run check:all
 pnpm run fix:all
-pnpm run test
+pnpm run test:unit
+# If this package declares an integration suite:
+pnpm run test:integration
 
 # From the workspace root — runs across all projects:
 pnpm run check:all
+pnpm run test:unit && pnpm run test:integration
 ```
 
+The root unit and integration scripts use Turbo to fan out the package-local
+`test:*:run` tasks across the standard TypeScript/Vitest workspaces. The Go
+workspace remains package-local because its tests run directly through Go:
+`pnpm --dir apps/cli-go run test:unit`. Go tests are covered by the dedicated
+Go CI workflow. Unit and integration tasks are uncached for now; e2e tasks are
+also uncached and run one package at a time. Forward a Vitest shard to every
+e2e package with `pnpm run test:e2e --shard=1/3`.
+
 ## E2E Compatibility Test Suite
 
 `apps/cli-e2e` implements the replay-and-record compatibility harness for the TypeScript Legacy CLI (`ts-legacy`, the only shipped CLI shell). Live tests are owned by `apps/cli` and run from the command they cover. The CLI still shells out to the bundled Go binary for the handful of commands the TS port proxies (`db diff`, `db pull`, `db branch *`, `db remote *`, `gen keys`, `functions download`), so `apps/cli-go/` is built alongside the TS CLI for these suites, but there is no Go-vs-TypeScript parity runner.
@@ -222,8 +232,8 @@ cd apps/cli-e2e
 pnpm test            # ts-legacy target (default and only target)
 pnpm test:legacy     # ts-legacy target (explicit, same as above)
 
-# Or via Nx from the repo root
-nx run @supabase/cli-e2e:test:e2e
+# Or via Turbo from the repo root
+pnpm --filter @supabase/cli-e2e run test:e2e
 ```
 
 ### Recording fixtures
@@ -344,20 +354,22 @@ Nx is the task runner for this repo. It handles caching, parallelism, and cross-
 
 ```sh
 nx run @supabase/api:types:check
-nx run supabase:test
 ```
 
+Ordinary unit, integration, and e2e tests are package-local scripts orchestrated
+from the workspace root with pnpm and Turbo; see [Standard package scripts](#standard-package-scripts).
+The live suite remains an Nx target documented below.
+
 **Run a target across all projects:**
 
 ```sh
 nx run-many -t types:check
 nx run-many -t lint:check fmt:check types:check knip:check
 ```
 
-**Run only affected projects** (compared to `main`):
+**Run only affected projects** (compared to `main`) for quality targets:
 
 ```sh
-nx affected -t test
 nx affected -t types:check
 ```
 
@@ -369,7 +381,7 @@ Lint, format, and knip targets live on the root project and always cover the who
 nx show project @supabase/api
 ```
 
-This is the best way to see what targets exist on a project, what their inputs and outputs are, and whether they are cached. Some targets are not declared in `package.json` but are injected by local Nx plugins — `types:check` and `test:unit` are examples of this.
+This is the best way to see what quality targets exist on a project, what their inputs and outputs are, and whether they are cached. Test orchestration is handled by Turbo's package-local `test:*:run` tasks instead.
 
 ### Caching
 

README.md

@@ -128,7 +128,7 @@ cd apps/cli
 
 pnpm dev:next -- --help
 pnpm check:all
-pnpm test:core
+pnpm run test:unit && pnpm run test:integration
 ```
 
 Useful source entry points:
@@ -157,7 +157,7 @@ Before opening a PR, run the checks for the workspace you touched.
 
 ```sh
 pnpm check:all
-pnpm test
+pnpm run test:unit && pnpm run test:integration
 ```
 
 PR titles must use conventional commits, for example:

apps/cli-e2e/package.json

@@ -4,11 +4,12 @@
   "private": true,
   "type": "module",
   "scripts": {
-    "test": "bun --bun vitest run",
-    "test:e2e": "bun --bun vitest run",
-    "test:legacy": "CLI_HARNESS_TARGET=ts-legacy bun --bun vitest run",
-    "test:next": "CLI_HARNESS_TARGET=ts-next bun --bun vitest run",
-    "record": "RECORD=true CLI_HARNESS_TARGET=ts-legacy bun --bun vitest run",
+    "test": "pnpm run test:e2e",
+    "test:e2e": "pnpm exec turbo run supabase#build && pnpm exec turbo run @supabase/cli-e2e#test:e2e:run --only --",
+    "test:e2e:run": "bun --bun vitest run",
+    "test:legacy": "CLI_HARNESS_TARGET=ts-legacy pnpm run test:e2e",
+    "test:next": "CLI_HARNESS_TARGET=ts-next pnpm run test:e2e",
+    "record": "RECORD=true CLI_HARNESS_TARGET=ts-legacy pnpm run test:e2e",
     "check:all": "nx run-many -t types:check lint:check fmt:check knip:check --projects=$npm_package_name,@supabase/root",
     "fix:all": "nx run-many -t lint:fix fmt:fix knip:fix --projects=$npm_package_name,@supabase/root"
   },

apps/cli-go/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "@supabase/cli-go",
+  "private": true,
+  "scripts": {
+    "build": "go build -o supabase-go .",
+    "test:unit": "pnpm exec turbo run @supabase/cli-go#test:unit:run --",
+    "test:unit:run": "go test ./..."
+  }
+}

apps/cli/AGENTS.md

@@ -452,9 +452,9 @@ Rules:
 
 ## Testing
 
-Use `bun run test` (not `bun test`) to run tests. The `package.json` `test` script runs all Vitest projects with coverage enabled for the `core` project.
+Use `pnpm run test` to run tests. The `package.json` `test` script runs the unit, integration, and e2e Vitest projects, with coverage enabled for unit and integration.
 
-Use `bun run test:core` for the main in-process suite, and `bun run test:e2e` for the sequential subprocess suite.
+Use `pnpm run test:unit && pnpm run test:integration` for the main in-process suite, and `pnpm run test:e2e` for the sequential subprocess suite.
 
 Always run the relevant unit and integration tests automatically for the command or workspace you changed.
 Do not run the full e2e suite automatically. Only run e2e when the user asks, or when you need extra confidence for the command you touched.
@@ -547,7 +547,7 @@ that run after crashes.
 After finishing any task or refactor, always run all quality checks before considering the work done:
 
 ```sh
-bun run test
+pnpm run test:unit && pnpm run test:integration
 bun run --parallel "*:check"
 ```
 

apps/cli/README.md

@@ -146,7 +146,7 @@ pnpm test
 Useful subsets:
 
 ```sh
-pnpm test:core                 # unit + integration (no binary required)
+pnpm run test:unit && pnpm run test:integration  # unit + integration (no binary required)
 pnpm test:legacy-integration   # legacy behavioral tests (requires SUPABASE_GO_BINARY — see CLAUDE.md)
 pnpm test:e2e                  # end-to-end subprocess tests
 ```

apps/cli/package.json

@@ -32,8 +32,13 @@
     "docs:spec": "bun scripts/generate-docs-spec.ts",
     "dev:next": "pnpm exec bun src/next/main.ts",
     "dev:legacy": "pnpm exec bun src/legacy/main.ts",
-    "test": "nx run-many -t test:core test:e2e --projects=$npm_package_name",
-    "test:core": "nx run-many -t test:unit test:integration --projects=$npm_package_name --coverage.enabled",
+    "test": "pnpm run test:unit --coverage.enabled && pnpm run test:integration --coverage.enabled && pnpm run test:e2e",
+    "test:unit": "pnpm exec turbo run supabase#test:unit:run --",
+    "test:unit:run": "bun --bun vitest run --project unit --coverage.reportsDirectory=coverage/unit",
+    "test:integration": "pnpm exec turbo run supabase#test:integration:run --",
+    "test:integration:run": "bun --bun vitest run --project integration --coverage.reportsDirectory=coverage/integration",
+    "test:e2e": "pnpm exec turbo run supabase#build && pnpm exec turbo run supabase#test:e2e:run --only --",
+    "test:e2e:run": "bun --bun vitest run --project e2e",
     "test:live": "bun --bun vitest run --project live",
     "test:smoke": "bun run tests/smoke-test.ts",
     "check:all": "nx run-many -t types:check lint:check fmt:check knip:check --projects=$npm_package_name,@supabase/root",
@@ -54,6 +59,14 @@
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@napi-rs/keyring": "^1.3.0",
     "@parcel/watcher": "^2.6.0",
+    "@parcel/watcher-darwin-arm64": "2.6.0",
+    "@parcel/watcher-darwin-x64": "2.6.0",
+    "@parcel/watcher-linux-arm64-glibc": "2.6.0",
+    "@parcel/watcher-linux-arm64-musl": "2.6.0",
+    "@parcel/watcher-linux-x64-glibc": "2.6.0",
+    "@parcel/watcher-linux-x64-musl": "2.6.0",
+    "@parcel/watcher-win32-arm64": "2.6.0",
+    "@parcel/watcher-win32-x64": "2.6.0",
     "@supabase/api": "workspace:*",
     "@supabase/config": "workspace:*",
     "@supabase/pg-delta": "1.0.0-alpha.46",

apps/cli/vitest.config.ts

@@ -45,6 +45,7 @@ export default defineConfig({
         test: {
           name: "unit",
           include: ["**/*.unit.test.ts"],
+          env: { FORCE_COLOR: "1" },
         },
       },
       {