name: Live E2E

on:

workflow_dispatch:

schedule:

# Hourly, offset from other scheduled workflows. Cron timing is best-effort.

- cron: "23 * * * *"

permissions:

contents: read

jobs:

# Decide whether to run. Manual dispatch always runs. Scheduled runs only fire

# when the latest published `@beta` is newer than the last one we tested green.

gate:

name: Gate (newer @beta?)

runs-on: ubuntu-latest

outputs:

should_run: ${{ steps.decide.outputs.should_run }}

version: ${{ steps.ver.outputs.version }}

steps:

- name: Resolve latest @beta version

id: ver

run: |

# Marker presence == "this beta already tested green". lookup-only so we

# download nothing; the marker is written by `finalize` after a green run.

- name: Check tested marker

id: cache

if: github.event_name == 'schedule'

uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5

with:

path: .beta-marker

key: live-e2e-beta-${{ steps.ver.outputs.version }}

lookup-only: true

- name: Decide

id: decide

run: |

live-e2e:

needs: gate

if: needs.gate.outputs.should_run == 'true'

name: Live e2e (${{ matrix.target }})

runs-on: blacksmith-8vcpu-ubuntu-2404

# Serialize a target against itself across runs; go and ts-legacy run in

# parallel. Per-job-scoped project names mean this is mostly belt-and-braces.

concurrency:

group: live-e2e-${{ matrix.target }}-${{ github.ref }}

cancel-in-progress: true

strategy:

# Each target is an independent green/red signal.

fail-fast: false

matrix:

# go = source-of-truth Go binary; ts-legacy = the TS rewrite (shells out

# to Go for most commands). Authoring target is go; ts-legacy proves the

# shim matches. ts-next is a later axis.

target:

- go

- ts-legacy

# Non-secret config is job-level; the staging token is scoped to only the two

# steps that need it (run + cleanup) so build/checkout/docker never see it.

env:

CLI_E2E_MODE: live

CLI_E2E_TARGET_ENV: staging

CLI_E2E_API_URL: https://api.supabase.green

CLI_E2E_PROJECT_HOST: supabase.red

CLI_HARNESS_TARGET: ${{ matrix.target }}

steps:

- name: Checkout

uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3

with:

persist-credentials: false

- name: Setup

uses: ./.github/actions/setup

- name: Setup Go

uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0

with:

go-version-file: apps/cli-go/go.mod

cache-dependency-path: apps/cli-go/go.sum

# Build the Go binary for every target: `go` runs it directly and

# `ts-legacy` shells out to it for most commands.

- name: Build Go CLI

working-directory: apps/cli-go

run: go build -o supabase-go .

- name: Export Go binary path

run: echo "SUPABASE_GO_BINARY=${{ github.workspace }}/apps/cli-go/supabase-go" >> "$GITHUB_ENV"

# The ts-legacy harness runs the compiled supabase binary from apps/cli/dist.

- name: Build CLI

if: matrix.target == 'ts-legacy'

run: pnpm exec nx run supabase:build

# Docker is a hard requirement for the --use-docker bundler cell.

- name: Docker preflight

run: docker info

- name: Run live e2e (retry up to 3x)

env:

SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_E2E_CLI_LIVE_STAGING_ACCESS_TOKEN }}

run: |

# Backstop: delete any project this job created that survived a crash.

# The script exits non-zero (failing this step) if any delete failed.

- name: Cleanup leftover projects

if: always()

env:

SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_E2E_CLI_LIVE_STAGING_ACCESS_TOKEN }}

run: bash .github/scripts/sweep-live-projects.sh "cli-e2e-live-${CLI_HARNESS_TARGET}-${GITHUB_RUN_ID}-"

# Record that this beta tested green so the next scheduled run skips it. Needs

# the whole matrix: the marker is saved only if BOTH go and ts-legacy passed

# (a red leg leaves no marker, so the next hour re-runs the same beta).

finalize:

needs: [gate, live-e2e]

if: github.event_name == 'schedule' && needs.live-e2e.result == 'success'

name: Mark @beta tested

runs-on: ubuntu-latest

steps:

- name: Write marker

run: |

- name: Save tested marker

uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5

with:

path: .beta-marker

key: live-e2e-beta-${{ needs.gate.outputs.version }}

/supabase/

fixtures/

`live` is a third mode (`CLI_E2E_MODE=live`) that, unlike replay/record, **does not use the replay server**. The harness is wired straight at the real Management API (`CLI_E2E_API_URL`) and the real Docker socket; tests assert on **real outcomes**.

- Live tests are `src/tests/live/**/*.live.e2e.test.ts`, run only via `vitest.live.config.ts` (the default config excludes them). They `skipIf(!isLive)`, so they are inert on the replay suite.

- Global setup (`tests/live-setup.ts`) provisions **one ephemeral project per run** (`cli-e2e-live-{target}-{runId}-{short}`), waits for `ACTIVE_HEALTHY`, resolves the anon JWT, the IPv4 **session-pooler `dbUrl`** (for `--db-url` DB commands), the functions URL, and a seeded storage bucket, exposing them via `inject()`. It deletes the project on teardown (even on failure). Setup is intentionally **dumb** — no provisioning retry; the CI job re-runs the step on flake.

- Use `testLive` from `src/tests/live/live-context.ts`: `run(cmd)` (direct-wired CLI), `invoke(slug)` (direct HTTP call sending the **anon JWT** in both `Authorization: Bearer` and `apikey`), plus `workspace` (a fresh `supabase init` config so golden paths exercise a generated config), `projectRef`, `anonKey`, `functionsUrl`, `dbUrl`, `storageBucket`. The functions deploy tests call `seedFunctions(workspace.path)` to layer the `deploy-e2e-*` fixtures + their `[functions.*]` config onto the init'd config.

- **Assertion style:** outcome-based — assert `exitCode`/`stdout` substrings and the function's HTTP status + JSON body. This is ID-agnostic, so **no normalization/snapshots by default**. If the CLI's own diagnostic output is ever the assertion target, add a scoped normalizer for that one test — do not make normalization the default.

- **Authoring target is `go`** (source of truth for the port); `ts-legacy` runs the same tests to prove the shim matches. Both run as separate CI jobs.

- Retargeting to another env (e.g. `supabox`) is an env swap only: `CLI_E2E_TARGET_ENV` + `CLI_E2E_API_URL` + `CLI_E2E_PROJECT_HOST` + token. Tests assert on function output, not hostnames.

- **CI triggers** (`.github/workflows/live-e2e.yml`): `workflow_dispatch` (manual; the Actions branch picker selects the ref — no free-form `ref` input, so the staging token never reaches arbitrary code) and an hourly `schedule`. There is **no `pull_request` trigger** — run it manually on a PR branch for pre-merge coverage. The scheduled run exercises the `@beta` channel: `develop` is the default branch and the beta release source, so it builds from `develop` source and runs the same `[go, ts-legacy]` matrix. A `gate` job skips the run unless the published `supabase@beta` version changed since the last green run (an `actions/cache` marker keyed on the version, written by `finalize` only after **both** legs pass), so a staging project is spent only when there is a new beta to test. Because the marker is written only on a fully-green matrix, a chronically-failing `@beta` keeps re-running every hour until it goes green or a newer beta supersedes it (intended — the failure stays visible).

cd apps/cli-go && go build -o /tmp/supabase-test-binary . && cd -

SUPABASE_GO_BINARY=/tmp/supabase-test-binary CLI_HARNESS_TARGET=go \

SUPABASE_ACCESS_TOKEN=sbp_... \

pnpm --filter @supabase/cli-e2e test:e2e:live

See `apps/cli-e2e/.env.example` for the full set of live/record env vars (copy to

a gitignored `.env.local`).

[functions."deploy-e2e-root-map"]

import_map = "./import_map.json"

[functions."deploy-e2e-custom-entry"]

entrypoint = "./functions/deploy-e2e-custom-entry/handler.ts"

[functions."deploy-e2e-static-in-fn"]

static_files = ["./functions/deploy-e2e-static-in-fn/static/*.txt"]

[functions."deploy-e2e-static-asset"]

static_files = ["./assets/*.svg", "./functions/deploy-e2e-static-asset/assets/*.svg"]

[functions."deploy-e2e-no-jwt"]

verify_jwt = false

export const greet = () => "hello";

{

"imports": {}

}