kanadgupta · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026 · Oct 23, 2026
@@ -1,4 +1,7 @@
-require-commit-hash: true # actions, reusable workflows and docker:// must be pinned to a full SHA / @sha256 digest
+rules:
+  missing-timeout: off
+  concurrency-limits: off
+  unpinned-uses: error # actions, reusable workflows and docker:// must be pinned to a full SHA / @sha256 digest
 self-hosted-runner:
   labels:
     - arm-runner
@@ -8,3 +11,8 @@ self-hosted-runner:
     - blacksmith-8vcpu-ubuntu-2404
     - blacksmith-8vcpu-windows-2025
     - blacksmith-32vcpu-ubuntu-2404
+paths:
+  # Other projects' repositories, pulled in as git submodules. CI never checks them out.
+  ".repos/**":
+    ignore:
+      - ".*"
@@ -12,7 +12,7 @@
  *
  * `resolveDecision` is the pure orchestration function (I/O injected) a test
  * can drive without the network; `main()` wires up the real GitHub I/O,
- * writes `should_run`/`pr_number`/`head_ref`/`trigger` to `$GITHUB_OUTPUT`,
+ * writes `should_run`/`pr_number`/`head_sha`/`trigger` to `$GITHUB_OUTPUT`,
  * and surfaces the skip reason (if any) in `$GITHUB_STEP_SUMMARY`.
  *
  * Run in CI as: `bun .github/scripts/ai-review/resolve.ts`.
@@ -374,7 +374,6 @@ function writeOutputs(result: ResolveResult, prNumber: number): void {
   const entries: Record<string, string> = {
     should_run: String(result.shouldRun),
     pr_number: String(prNumber),
-    head_ref: `refs/pull/${prNumber}/head`,
     head_sha: result.headSha ?? "",
     trigger: result.trigger,
   };

@@ -16,6 +16,10 @@ on:
         description: "PR number to review"
         required: true
         type: string
+  # A `/ai-review` comment on a pull request starts a review. The resolve job checks who
+  # commented, and the one job that can write to the pull request runs code from the default
+  # branch only, never from the pull request.
+  # jactionlint ignore=dangerous-triggers
   issue_comment:
     types:
       - created
@@ -65,7 +69,6 @@ jobs:
     outputs:
       should_run: ${{ steps.resolve.outputs.should_run }}
       pr_number: ${{ steps.resolve.outputs.pr_number }}
-      head_ref: ${{ steps.resolve.outputs.head_ref }}
       # Every job reviews this commit, so a push during the run is never reported as reviewed.
       head_sha: ${{ steps.resolve.outputs.head_sha }}
       trigger: ${{ steps.resolve.outputs.trigger }}
@@ -161,7 +164,10 @@ jobs:
       # behavior mid-rollout. Installed from the trusted checkout with npm config isolation so a
       # PR-supplied `.npmrc` in the untrusted `pr` checkout can never redirect this install to a
       # hostile registry.
-      # 2.1.280 is the first release that accepts claude-opus-5-5.
+      # 2.1.280 is the first release that accepts claude-opus-5-5. The CLI is installed on its
+      # own, not through the repository's lockfile, so nothing in the pull request's checkout
+      # can change what gets installed.
+      # jactionlint ignore=adhoc-packages
       - name: Install Claude Code CLI
         working-directory: trusted
         run: |
@@ -544,7 +550,7 @@ jobs:
     steps:
       # Security-critical: this is the only job with write permission, so it must only ever
       # execute trusted base-branch code — never the PR head. Checking out `develop` explicitly
-      # (never `needs.resolve.outputs.head_ref`) keeps a malicious PR from smuggling a script
+      # (never the PR's own ref) keeps a malicious PR from smuggling a script
       # change into the one job that can write back to the PR. (For `pull_request` events GitHub
       # runs the workflow file from the PR's own ref; acceptable since the auto path only admits
       # same-repo PRs, whose authors hold write access anyway, and fork PRs run with a read-only

@@ -27,13 +27,14 @@ jobs:
     outputs:
       authorized: ${{ steps.check.outputs.authorized }}
     steps:
-      # App token needs org membership read, repo write to edit the release, and PR write to
-      # comment and close.
+      # The token reads the approver's team membership and comments on the pull request.
       - id: app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ vars.GH_APP_CLIENT_ID }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+          permission-members: read
+          permission-pull-requests: write
 
       - name: Authorize approver against supabase/cli team
         id: check
@@ -66,11 +67,16 @@ jobs:
       contents: write
       pull-requests: write
     steps:
+      # The token edits the GitHub release, deletes the branch, and comments on and closes the
+      # pull request. The script below runs from the pull request's own checkout, so the token
+      # must not be able to change workflow files.
       - id: app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ vars.GH_APP_CLIENT_ID }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       # Checkout the PR head so reviewer edits made before approval are captured;
       # apply-release-notes.ts reads from the working tree.

@@ -1,6 +1,9 @@
 name: Bot PR auto-merge
 
 on:
+  # Only this event lets the job use the auto-approve environment's secret. The job never
+  # checks out or runs code from the pull request.
+  # jactionlint ignore=dangerous-triggers
   pull_request_target:
     types: [opened, reopened, synchronize, ready_for_review]
     branches: [develop]
@@ -14,6 +17,9 @@ jobs:
     # Other apps (coding agents, CI vendors) also open PRs here and still need a maintainer.
     # Release-notes PRs are published by a maintainer approval and must never merge. Branch sync
     # PRs land by fast-forward on a maintainer approval, never by a squash.
+    # The first condition checks who opened the pull request. The second checks who caused this
+    # event, so a person pushing to a bot's pull request does not get it approved.
+    # jactionlint ignore=bot-conditions
     if: >-
       contains(fromJSON('["dependabot[bot]", "supabase-cli-releaser[bot]"]'), github.event.pull_request.user.login) &&
       contains(fromJSON('["dependabot[bot]", "supabase-cli-releaser[bot]"]'), github.event.sender.login) &&

@@ -31,6 +31,7 @@ jobs:
       # Required by: internal/utils/credentials/keyring_test.go
       - uses: t1m0thyj/unlock-keyring@cbcf205c879ebd86add70bab3a6abfcce59a5cae # v1.2.0
       - run: |
+          set -o pipefail
           pkgs=$(go list ./pkg/... | grep -Ev 'pkg/api' | paste -sd ',' -)
           go tool gotestsum -- -race -v -count=1 ./... \
           -coverpkg="./cmd/...,./internal/...,${pkgs}" -coverprofile=coverage.out

@@ -19,14 +19,15 @@ on:
         required: true
         type: string
 
-permissions:
-  contents: read
-  packages: write
-  id-token: write
+permissions: {}
 
 jobs:
   mirror:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
     steps:
       - id: strip
         env:

@@ -38,8 +38,6 @@ jobs:
             arch: arm64
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 180
-    outputs:
-      image_digest: ${{ steps.build.outputs.digest }}
     steps:
       - run: docker context create builders
       - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

@@ -38,8 +38,6 @@ jobs:
             arch: arm64
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 180
-    outputs:
-      image_digest: ${{ steps.build.outputs.digest }}
     steps:
       - run: docker context create builders
       - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0

@@ -8,13 +8,14 @@ on:
         required: true
         type: string
 
-permissions:
-  contents: write
+permissions: {}
 
 jobs:
   tag:
     name: Create pkg tag
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

@@ -22,10 +22,7 @@ on:
         type: string
         default: "security,pinned,do-not-close,keep-open,do not merge"
 
-permissions:
-  contents: read
-  issues: write
-  pull-requests: write
+permissions: {}
 
 concurrency:
   group: close-stale-issues-and-prs
@@ -35,6 +32,10 @@ jobs:
   close-stale:
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
     steps:
       - name: Close stale issues and PRs
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

@@ -1,6 +1,9 @@
 name: Contribution Gate
 
 on:
+  # The gate has to comment on pull requests from forks, which only this event's token can do.
+  # It checks out the base branch, never the pull request.
+  # jactionlint ignore=dangerous-triggers
   pull_request_target:
     types:
       - opened
@@ -16,10 +19,7 @@ on:
         type: boolean
         default: false
 
-permissions:
-  pull-requests: write
-  issues: read
-  contents: read
+permissions: {}
 
 concurrency:
   # Per-PR for pull_request_target; unique per run for manual sweeps (which
@@ -31,6 +31,10 @@ jobs:
   gate-single:
     name: Contribution Gate
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      issues: read
+      contents: read
     # Exempt maintainers/collaborators and bots. External contributors are gated.
     if: >
       github.event_name == 'pull_request_target' &&
@@ -42,6 +46,8 @@ jobs:
       # Checks out the base repo (default for pull_request_target), so the gate
       # runs trusted code from the base branch, never the untrusted PR head.
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: ".bun-version"
@@ -58,11 +64,17 @@ jobs:
   gate-all:
     name: Contribution Gate (all open PRs)
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
+      issues: read
+      contents: read
     if: github.event_name == 'workflow_dispatch'
     steps:
       # Base-branch checkout only — the sweep makes API calls and never runs
       # any PR's code.
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: ".bun-version"

@@ -37,6 +37,7 @@ jobs:
           CLI_SHA: ${{ github.event.pull_request.head.sha }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
+          set -o pipefail
           echo "Dispatching cli-e2e-ci live run for PR #${PR_NUMBER} @ ${CLI_SHA}"
           # Build the nested client_payload with jq — `gh api -f` sends a flat
           # body and would not nest `client_payload.*` correctly.

@@ -72,13 +72,15 @@ jobs:
 
       - name: Pull stack package images
         run: |
+          set -o pipefail
           pnpm --silent --filter @supabase/stack prepare:test-artifacts --images |
             xargs --max-procs 4 --max-args 1 docker pull --quiet
 
       # Also runs after a failed step so leftover stack containers and volumes never persist.
       - name: Prune Docker before saving its image disk
         if: always()
         run: |
+          set -o pipefail
           docker ps --all --quiet | xargs --no-run-if-empty docker rm --force
           docker system prune --force
           docker volume prune --all --force

@@ -1,6 +1,8 @@
 name: Live E2E Notifications
 
 on:
+  # The job only reads whether the run passed. It runs nothing the run produced.
+  # jactionlint ignore=dangerous-triggers
   workflow_run:
     workflows: [Live E2E, Release]
     types: [completed]

@@ -61,6 +61,9 @@ jobs:
         with:
           client-id: ${{ vars.GH_APP_CLIENT_ID }}
           private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-issues: read
+          permission-pull-requests: write
 
       - uses: useblacksmith/checkout@6fd481652155169ed4d2f25ebaf97464f685175f # v1
         with:

@@ -355,19 +355,24 @@ jobs:
           fi
           echo "dist-tag ${NPM_TAG} -> ${VERSION} confirmed."
 
+      # The CLI's install scripts and setup-cli resolve releases/latest/download/..., so a
+      # config release must never become the repo's "latest" release. Re-runs skip this step
+      # when the release already exists.
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
-        with:
-          token: ${{ github.token }}
-          tag_name: config-v${{ needs.plan.outputs.version }}
-          name: "@supabase/config v${{ needs.plan.outputs.version }}"
-          body_path: ${{ runner.temp }}/config-release/config-release-notes.md
-          draft: false
-          prerelease: false
-          # The CLI's install scripts and setup-cli resolve
-          # releases/latest/download/..., so a config release must never
-          # become the repo's "latest" release.
-          make_latest: "false"
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          tag="config-v${VERSION}"
+          if gh release view "${tag}" >/dev/null 2>&1; then
+            echo "Release ${tag} already exists; skipping."
+          else
+            gh release create "${tag}" \
+              --verify-tag \
+              --title "@supabase/config v${VERSION}" \
+              --notes-file "${RUNNER_TEMP}/config-release/config-release-notes.md" \
+              --latest=false
+          fi
 
   # Pages Slack the moment a real run arms the config-release approval gate. Runs in parallel
   # with the publish job's `waiting` state (needs only `plan`), so the ping and the pending

@@ -307,6 +307,8 @@ jobs:
         with:
           dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
 
+      # The cache key includes this run's id, so only this run's build job can have written it.
+      # jactionlint ignore=cache-poisoning
       - name: Restore build artifacts cache
         uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
@@ -377,13 +379,23 @@ jobs:
           done
 
       # Created empty; the next step uploads the assets so each one can be retried on its own.
+      # Re-runs skip this step when the release already exists.
       - name: Create draft GitHub Release
-        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
-        with:
-          tag_name: v${{ inputs.version }}
-          name: v${{ inputs.version }}
-          draft: true
-          prerelease: ${{ inputs.prerelease }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PRERELEASE: ${{ inputs.prerelease }}
+        run: |
+          set -euo pipefail
+          tag="v${VERSION}"
+          if gh release view "${tag}" >/dev/null 2>&1; then
+            echo "Release ${tag} already exists; skipping."
+          else
+            args=(--draft --verify-tag --title "${tag}")
+            if [[ "$PRERELEASE" == true ]]; then
+              args+=(--prerelease)
+            fi
+            gh release create "${tag}" "${args[@]}"
+          fi
 
       # One asset at a time with per-asset retries; see apps/cli/scripts/upload-release-assets.ts.
       - name: Upload release assets