feat(config): publish @supabase/config to npm (CLI-2169) by Coly010 · Pull Request #6423 · supabase/cli

Coly010 · 2026-09-01T13:12:21Z

What kind of change does this PR introduce?

Feature — flips packages/config to private: false, activating the publish half of the release pipeline that landed in #6381, and drops the README's "not yet published" caveat.

What is the current behavior?

@supabase/config is private: true: every push touching packages/config/** rehearses the plan half of the Release Config workflow (version computation, build, pack, type-surface gate), but should_release stays false and nothing publishes. npm currently hosts only a 0.0.0 placeholder stub.

What is the new behavior?

Merging this PR is the package's first real release. The squash commit (feat(config)) is the first releasable commit since the config-v0.0.0 baseline tag, so the Release Config workflow will:

plan 0.1.0 (minor over the 0.0.0 stub baseline),
pack the tarball and generate the approval evidence — since the stub contains no .d.ts, the type-surface gate renders the entire public surface as additions for the approver,
wait on config-release environment approval (required reviewers configured),
publish that exact tarball via OIDC trusted publishing, push config-v0.1.0, and create the GitHub release (never repo-"latest").

Go-live preconditions, all in place: npm trusted publisher configured and bootstrap token revoked (verified with infra/security), config-release environment armed with required reviewers, config-v0.0.0 baseline tag pushed at ed81a1c and verified green (plan run reports "0 commits: no release" pre-merge).

Part of CLI-2169.

Flips packages/config to private: false so the release pipeline's publish half activates, and drops the README's not-yet-published caveat. On merge, this commit is the first releasable commit since the config-v0.0.0 baseline tag, so the Release Config workflow will plan 0.1.0 as the package's first real release, pending config-release environment approval.

github-actions · 2026-09-01T13:36:10Z

Supabase CLI preview

npx --yes https://pkg.pr.new/supabase/cli/supabase@9e0527a8a42bc494a0c4e4bcc2006b99de569a38

Preview package for commit 9e0527a.

github-actions

🤖 AI Review

No functional defect was identified in the two-line publication-enablement change. Of Claude's four documentation findings, two are confirmed, one depends on unverifiable external release setup, and one is refuted. Codex's independent review completed with no findings.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	`packages/config/AGENTS.md:159`	`documentation`	claude	The one-time setup section may now be stale: it still describes the first publication as pending and directs operators to bootstrap it manually with an npm token.
⚪ NIT	`CLAUDE.md:36`	`documentation`	claude	The workspace-convention documentation omits packages/config from its list of published, non-private exceptions.
⚪ NIT	`.github/workflows/release-config.yml:104`	`documentation`	claude	Release workflow comments and private-blocked diagnostics still describe the CLI-2169 private-to-public flip as a future event after this PR performs that flip.

Findings outside the diff

🟡 MINOR packages/config/AGENTS.md:159 — The one-time setup section may now be stale: it still describes the first publication as pending and directs operators to bootstrap it manually with an npm token.
⚪ NIT CLAUDE.md:36 — The workspace-convention documentation omits packages/config from its list of published, non-private exceptions.
⚪ NIT .github/workflows/release-config.yml:104 — Release workflow comments and private-blocked diagnostics still describe the CLI-2169 private-to-public flip as a future event after this PR performs that flip.

Refuted findings (kept for transparency, not posted as review comments)

packages/config/README.md:33 (documentation): The sentence "Install it alongside the peers your runtime needs" leaves "it" without an antecedent.
Refuted: The heading, section context, and immediately preceding install command provide an unambiguous antecedent: @supabase/config. The following paragraph reinforces that interpretation by calling it "This package."

Stats

Claude findings: 4 · Codex findings: 0 · Confirmed: 2 · Refuted: 1 · Uncertain: 1

Models: claude-opus-5 + gpt-5.6-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

…LI-2169) The go-live setup (environment reviewers, trusted publisher, baseline tag, config-v* tag ruleset) is complete, so AGENTS.md's one-time-setup section now records the standing invariants to verify/restore instead of pending steps, the workspace-conventions doc lists packages/config as a published exception, and the workflow comments and private-blocked diagnostics treat private: true as a regression guard rather than a future flip.

Coly010 · 2026-09-01T14:28:14Z

All three AI-review findings addressed in 46885d1 (all accepted; they were outside-diff doc staleness, so no threads to resolve):

AGENTS.md one-time setup (minor): rewritten as "Standing release configuration" — the four items are now recorded as completed invariants to verify/restore (environment reviewers, trusted publisher + 0.0.0 placeholder bootstrap, config-v0.0.0 baseline matching the registry, the config-v* tag ruleset with the supabase-cli-releaser bypass) instead of pending steps.
Workspace conventions (nit): packages/config added to the published, non-private exceptions list.
Workflow comments/diagnostics (nit): the private-blocked path is now described as a regression guard ("if private were ever flipped back on…") rather than a future CLI-2169 event, in both comments and the runtime messages.

…span (ci: fmt:check) An unescaped * inside a bold span is an emphasis delimiter to CommonMark, so oxfmt --check rejected the committed text.

…hema (supabase#6425) ## What kind of change does this PR introduce? Bug fix (CI). ## What is the current behavior? The `Codegen` job in the `CI` workflow runs `go generate` against the live Management API spec (`api.supabase.green`) and fails the build if the checked-in `pkg/api` files drift from what it produces. Upstream started splitting every response component schema into a base and `_Output` variant (e.g. `JitListAccessResponse` -> `JitListAccessResponse_Output`), which broke three `apps/cli-go/api/overlay.yaml` selectors targeting the old schema name: ``` failed to apply Overlay "api/overlay.yaml" ... selector "$.components.schemas.JitListAccessResponse.properties.items.items.anyOf[0].properties.invite_id" did not match any targets ``` This has failed the `Codegen` check on every `develop` commit since supabase#6417 (merged 2026-09-01), blocking the merge queue for all PRs since the `merge_group` trigger has no path filter. ## What is the new behavior? - `overlay.yaml` selectors repointed at `JitListAccessResponse_Output` (schema shape is unchanged, only the name). - Regenerated `pkg/api/{types,client}.gen.go` against the current live spec, which also renames every other response schema type to its `*Output` counterpart. - Renamed all downstream Go references (`pkg/config`, `pkg/function`, `internal/utils`, `internal/telemetry`, `internal/functions/download`) to the new `*Output` type names so the module still builds. Verified: `go build ./...`, `go vet ./...`, `golangci-lint run`, and `go generate` (re-run to confirm idempotency) all pass in `apps/cli-go`. `go test ./...` in `apps/cli-go` is green aside from two pre-existing, environment-only failures (no local Docker daemon). `pkg/config`'s test suite has ~20 pre-existing failures that are identical on a clean `develop` checkout (confirmed via a baseline worktree) — unrelated to this change, and that submodule isn't part of the CI `Test` job's scope anyway. ## Related Issue(s) Unblocks the merge queue (e.g. supabase#6423).

Coly010 self-assigned this Sep 1, 2026

Coly010 marked this pull request as ready for review September 1, 2026 13:28

Coly010 requested a review from a team as a code owner September 1, 2026 13:28

github-actions Bot reviewed Sep 1, 2026

View reviewed changes

docs(config): backtick the config-v* literal inside the ruleset bold …

9e0527a

…span (ci: fmt:check) An unescaped * inside a bold span is an emphasis delimiter to CommonMark, so oxfmt --check rejected the committed text.

jgoux approved these changes Sep 1, 2026

View reviewed changes

avallete approved these changes Sep 1, 2026

View reviewed changes

kanadgupta approved these changes Sep 1, 2026

View reviewed changes

Coly010 added this pull request to the merge queue Sep 1, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Sep 1, 2026

Coly010 added this pull request to the merge queue Sep 1, 2026

github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Sep 1, 2026

Coly010 mentioned this pull request Sep 1, 2026

fix(cli-go): repoint overlay.yaml at renamed JitListAccessResponse schema #6425

Merged

Coly010 added this pull request to the merge queue Sep 1, 2026

Merged via the queue into develop with commit ed426e5 Sep 1, 2026
42 checks passed

Coly010 deleted the columferry/cli-2169-publish-the-supabaseconfig-npm-package-from-cli-repo branch September 1, 2026 18:37

Navigation Menu

Uh oh!

feat(config): publish @supabase/config to npm (CLI-2169) - #6423

feat(config): publish @supabase/config to npm (CLI-2169)#6423
Coly010 merged 3 commits into
developfrom
columferry/cli-2169-publish-the-supabaseconfig-npm-package-from-cli-repo

Coly010 commented Sep 1, 2026

Uh oh!

github-actions Bot commented Sep 1, 2026 •

edited

Loading

Uh oh!

github-actions Bot left a comment

Uh oh!

Coly010 commented Sep 1, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

Coly010 commented Sep 1, 2026

What kind of change does this PR introduce?

What is the current behavior?

What is the new behavior?

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Supabase CLI preview

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

🤖 AI Review

Findings

Findings outside the diff

Stats

Uh oh!

Coly010 commented Sep 1, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented Sep 1, 2026 •

edited

Loading