ci(cli): publish pkg.pr.new previews after preview builds

.github/workflows/build-cli-artifacts.yml

@@ -0,0 +1,88 @@
+name: Build CLI Artifacts
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        description: CLI package version to build
+        required: true
+        type: string
+      shell:
+        description: CLI shell to package as the shipped supabase binary
+        required: true
+        type: string
+      ref:
+        description: Optional git ref or SHA to check out before building
+        required: false
+        type: string
+        default: ""
+    secrets:
+      SENTRY_DSN:
+        required: false
+      POSTHOG_API_KEY:
+        required: false
+      POSTHOG_ENDPOINT:
+        required: false
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build CLI artifacts
+    runs-on: blacksmith-32vcpu-ubuntu-2404
+    env:
+      BUN_SHELL: ${{ inputs.shell }}
+      VERSION: ${{ inputs.version }}
+      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
+      POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
+      POSTHOG_ENDPOINT: ${{ secrets.POSTHOG_ENDPOINT }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ inputs.ref }}
+          persist-credentials: false
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Setup Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: apps/cli-go/go.mod
+          cache: true
+          cache-dependency-path: apps/cli-go/go.sum
+
+      - name: Pre-download Go modules
+        working-directory: apps/cli-go
+        run: go mod download -x
+
+      - name: Install nfpm
+        run: |
+          echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list
+          sudo apt-get update
+          sudo apt-get install -y nfpm
+
+      - name: Sync versions
+        run: pnpm exec bun apps/cli/scripts/sync-versions.ts --version "${VERSION}"
+
+      - name: Build selected shell
+        run: pnpm exec bun apps/cli/scripts/build.ts --version "${VERSION}" --shell "${BUN_SHELL}"
+
+      - name: Verify build artifacts
+        run: |
+          for pkg in cli-darwin-arm64 cli-darwin-x64 cli-linux-arm64 cli-linux-arm64-musl cli-linux-x64 cli-linux-x64-musl cli-windows-arm64 cli-windows-x64; do
+            echo "Checking packages/$pkg/bin/..."
+            ls -la "packages/$pkg/bin/"
+          done
+          echo "Checking dist/..."
+          ls -la dist/
+
+      - name: Upload build artifacts
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: cli-build-${{ inputs.shell }}-${{ inputs.version }}
+          path: |
+            packages/cli-*/bin/
+            dist/

.github/workflows/publish-preview-cli-packages.yml

@@ -0,0 +1,214 @@
+name: Publish Preview CLI Packages
+
+on:
+  workflow_run:
+    workflows:
+      - Test
+    types:
+      - completed
+
+permissions:
+  actions: read
+  contents: read
+  pull-requests: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.workflow_run.head_sha || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  resolve:
+    if: >-
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+    name: Resolve preview build context
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ github.token }}
+      REPOSITORY: ${{ github.repository }}
+    outputs:
+      should_build: ${{ steps.context.outputs.should_build }}
+      pr_number: ${{ steps.context.outputs.pr_number }}
+      pr_head_sha: ${{ steps.context.outputs.pr_head_sha }}
+      preview_version: ${{ steps.context.outputs.preview_version }}
+    steps:
+      - name: Resolve PR context
+        id: context
+        run: |
+          set -euo pipefail
+
+          should_build=false
+          pr_number="$(jq -r '.workflow_run.pull_requests[0].number // ""' "$GITHUB_EVENT_PATH")"
+          pr_head_sha="$(jq -r '.workflow_run.head_sha // ""' "$GITHUB_EVENT_PATH")"
+          pr_head_branch="$(jq -r '.workflow_run.head_branch // ""' "$GITHUB_EVENT_PATH")"
+
+          if [[ -z "${pr_head_sha}" ]]; then
+            echo "Workflow run has no head SHA; skipping."
+            echo "should_build=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [[ -z "${pr_number}" && -n "${pr_head_branch}" ]]; then
+            pr_number="$(
+              gh pr list \
+                --repo "${REPOSITORY}" \
+                --head "${pr_head_branch}" \
+                --state open \
+                --json number,headRefOid \
+                --jq 'map(select(.headRefOid == "'"${pr_head_sha}"'")) | .[0].number // ""'
+            )"
+          fi
+
+          if [[ -z "${pr_number}" ]]; then
+            echo "Test run is not associated with an open pull request; skipping."
+            echo "should_build=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          pr_json="$(gh api "repos/${REPOSITORY}/pulls/${pr_number}")"
+          current_head_sha="$(jq -r '.head.sha' <<< "${pr_json}")"
+          state="$(jq -r '.state' <<< "${pr_json}")"
+          draft="$(jq -r '.draft' <<< "${pr_json}")"
+          head_repo="$(jq -r '.head.repo.full_name' <<< "${pr_json}")"
+          base_repo="$(jq -r '.base.repo.full_name' <<< "${pr_json}")"
+
+          if [[ "${state}" != "open" ]]; then
+            echo "PR #${pr_number} is ${state}; skipping."
+            echo "should_build=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [[ "${draft}" == "true" ]]; then
+            echo "PR #${pr_number} is draft; skipping."
+            echo "should_build=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [[ "${head_repo}" != "${base_repo}" ]]; then
+            echo "PR #${pr_number} comes from fork ${head_repo}; skipping."
+            echo "should_build=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          if [[ "${pr_head_sha}" != "${current_head_sha}" ]]; then
+            echo "Test SHA ${pr_head_sha} is stale; current PR head is ${current_head_sha}. Skipping."
+            echo "should_build=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          preview_version="0.0.0-pr.${pr_number}"
+          should_build=true
+
+          {
+            echo "should_build=${should_build}"
+            echo "pr_number=${pr_number}"
+            echo "pr_head_sha=${pr_head_sha}"
+            echo "preview_version=${preview_version}"
+          } >> "$GITHUB_OUTPUT"
+
+  build:
+    needs: resolve
+    if: needs.resolve.outputs.should_build == 'true'
+    name: Build preview CLI packages
+    uses: ./.github/workflows/build-cli-artifacts.yml
+    with:
+      version: ${{ needs.resolve.outputs.preview_version }}
+      shell: legacy
+      ref: ${{ needs.resolve.outputs.pr_head_sha }}
+
+  publish:
+    needs: [resolve, build]
+    if: needs.resolve.outputs.should_build == 'true' && needs.build.result == 'success'
+    name: Publish preview package
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      issues: write
+      pull-requests: read
+    env:
+      GH_TOKEN: ${{ github.token }}
+      PREVIEW_VERSION: ${{ needs.resolve.outputs.preview_version }}
+      PR_HEAD_SHA: ${{ needs.resolve.outputs.pr_head_sha }}
+      PR_NUMBER: ${{ needs.resolve.outputs.pr_number }}
+      REPOSITORY: ${{ github.repository }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ needs.resolve.outputs.pr_head_sha }}
+          persist-credentials: false
+
+      - name: Setup
+        uses: ./.github/actions/setup
+
+      - name: Download preview build artifacts
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: cli-build-legacy-${{ needs.resolve.outputs.preview_version }}
+
+      - name: Prepare package files
+        run: |
+          set -euo pipefail
+          pnpm exec bun apps/cli/scripts/sync-versions.ts --version "${PREVIEW_VERSION}"
+          pnpm --dir apps/cli build:shim
+          find packages -path '*/bin/supabase*' -type f -exec chmod +x {} +
+
+      - name: Publish preview package
+        run: |
+          pnpm exec pkg-pr-new publish \
+            --pnpm \
+            --bin \
+            --comment=off \
+            --json pkg-pr-new.json \
+            --no-template \
+            './packages/cli-darwin-arm64' \
+            './packages/cli-darwin-x64' \
+            './packages/cli-linux-arm64' \
+            './packages/cli-linux-arm64-musl' \
+            './packages/cli-linux-x64' \
+            './packages/cli-linux-x64-musl' \
+            './packages/cli-windows-arm64' \
+            './packages/cli-windows-x64' \
+            './apps/cli'
+
+      - name: Smoke test preview command
+        run: |
+          set -euo pipefail
+          preview_url="https://pkg.pr.new/supabase@${PR_NUMBER}"
+          npx --yes "${preview_url}" --version
+
+      - name: Update PR comment
+        run: |
+          set -euo pipefail
+          preview_url="https://pkg.pr.new/supabase@${PR_NUMBER}"
+          short_sha="${PR_HEAD_SHA:0:7}"
+          marker="<!-- pkg-pr-new-preview -->"
+          cat > comment.md <<EOF
+          ${marker}
+          ## pkg.pr.new preview
+
+          Published version \`${PREVIEW_VERSION}\` from commit [\`${short_sha}\`](https://github.com/${REPOSITORY}/commit/${PR_HEAD_SHA}) after tests passed.
+
+          \`\`\`sh
+          npx ${preview_url}
+          \`\`\`
+
+          \`\`\`sh
+          npx ${preview_url} --version
+          \`\`\`
+          EOF
+
+          jq -n --rawfile body comment.md '{ body: $body }' > comment.json
+          comment_id="$(
+            gh api "repos/${REPOSITORY}/issues/${PR_NUMBER}/comments" \
+              --paginate \
+              --jq '.[] | select(.body | contains("'"${marker}"'")) | .id' \
+              | head -n1
+          )"
+
+          if [[ -n "${comment_id}" ]]; then
+            gh api --method PATCH "repos/${REPOSITORY}/issues/comments/${comment_id}" --input comment.json >/dev/null
+          else
+            gh api --method POST "repos/${REPOSITORY}/issues/${PR_NUMBER}/comments" --input comment.json >/dev/null
+          fi

.github/workflows/release-shared.yml

@@ -53,75 +53,27 @@ on:
         required: false
 jobs:
   build:
-    runs-on: blacksmith-32vcpu-ubuntu-2404
-    env:
-      BUN_SHELL: ${{ inputs.shell }}
-      VERSION: ${{ inputs.version }}
+    name: Build CLI artifacts
+    uses: ./.github/workflows/build-cli-artifacts.yml
+    with:
+      version: ${{ inputs.version }}
+      shell: ${{ inputs.shell }}
+    secrets:
       SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
       POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_KEY }}
       POSTHOG_ENDPOINT: ${{ secrets.POSTHOG_ENDPOINT }}
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Setup
-        uses: ./.github/actions/setup
-
-      - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
-        with:
-          go-version-file: apps/cli-go/go.mod
-          cache: true
-          cache-dependency-path: apps/cli-go/go.sum
-
-      - name: Pre-download Go modules
-        working-directory: apps/cli-go
-        run: go mod download -x
-
-      - name: Install nfpm
-        run: |
-          echo 'deb [trusted=yes] https://repo.goreleaser.com/apt/ /' | sudo tee /etc/apt/sources.list.d/goreleaser.list
-          sudo apt-get update
-          sudo apt-get install -y nfpm
-
-      - name: Sync versions
-        run: pnpm exec bun apps/cli/scripts/sync-versions.ts --version "${VERSION}"
-
-      - name: Build selected shell
-        run: pnpm exec bun apps/cli/scripts/build.ts --version "${VERSION}" --shell "${BUN_SHELL}"
-
-      - name: Verify build artifacts
-        run: |
-          for pkg in cli-darwin-arm64 cli-darwin-x64 cli-linux-arm64 cli-linux-arm64-musl cli-linux-x64 cli-linux-x64-musl cli-windows-arm64 cli-windows-x64; do
-            echo "Checking packages/$pkg/bin/..."
-            ls -la "packages/$pkg/bin/"
-          done
-          echo "Checking dist/..."
-          ls -la dist/
-
-      - name: Upload build artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: cli-build-${{ inputs.shell }}-${{ inputs.version }}
-          path: |
-            packages/cli-*/bin/
-            dist/
 
   smoke-test:
     needs: build
     strategy:
       fail-fast: false
-      # macos-15-intel is the slowest smoke leg and the only one not on
-      # Blacksmith (Blacksmith macOS is ARM-only). Drop it from the matrix
-      # on prereleases (PR smoke + develop -> beta) so beta wall-clock isn't
-      # gated by it; stable releases on main still run the full matrix.
-      # The matrix list is built via fromJSON because GitHub Actions does
-      # not allow the `matrix` context in a job-level `if:` (matrix
-      # expansion happens after job conditions are evaluated).
       matrix:
-        runner: ${{ fromJSON(inputs.prerelease && '["blacksmith-8vcpu-ubuntu-2404","blacksmith-6vcpu-macos-latest","blacksmith-8vcpu-windows-2025"]' || '["blacksmith-8vcpu-ubuntu-2404","blacksmith-6vcpu-macos-latest","macos-15-intel","blacksmith-8vcpu-windows-2025"]') }}
+        runner:
+          - blacksmith-8vcpu-ubuntu-2404
+          - blacksmith-6vcpu-macos-latest
+          - macos-15-intel
+          - blacksmith-8vcpu-windows-2025
+          - windows-11-arm
     runs-on: ${{ matrix.runner }}
     env:
       NPM_TAG: ${{ inputs.npm_tag }}