hosted-supabase.yml

# The fleet self-hosts Supabase. This proves no repo still says otherwise.
#
# botsmann served PGRST205 from /api/health for months because its setup doc
# described a managed-cloud project we had already left, and told you to apply
# migrations by pasting SQL into a dashboard that does not exist for us. Nobody
# pasted anything, so its eleven migrations were never applied — while every
# deploy went green. The docs were not stale clutter; they were the outage.
#
# Fixing those files once clears today's copies. This is what stops the next one.
name: Hosted Supabase audit

on:
  schedule:
    # Weekly. A hosted reference enters on the timescale of someone writing a
    # doc or copying an old script, not of individual commits — daily would be
    # noise, and noise gets muted.
    - cron: '27 6 * * 1'
  workflow_dispatch:

permissions:
  contents: read

concurrency:
  group: hosted-supabase-audit
  cancel-in-progress: true

jobs:
  audit:
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v7

      # Pure, no checkout of anything else. If the audit's own judgement breaks,
      # the sweep below would still print a confident tick.
      - name: The audit still detects, and still stays quiet
        run: bash scripts/ci/test-hosted-supabase-audit.sh

      # GitHub code search returns nothing for these repos, so a full-text sweep
      # cannot be done through the API. Shallow-cloning is the cheap honest
      # alternative: --depth 1 --filter=blob:none keeps it to seconds per repo,
      # and the audit reads `origin/main`, never a working tree.
      - name: Clone the fleet
        env:
          # Same gap as the shared inventory, stated rather than hidden: the
          # default token reads public repos only, so private ones are silently
          # omitted. The audit prints how many repos it swept — a drop in that
          # number is the tell. Set FLEET_READ_TOKEN to cover all of them.
          GH_TOKEN: ${{ secrets.FLEET_READ_TOKEN || secrets.GITHUB_TOKEN }}
        run: |
          set -uo pipefail
          mkdir -p "$RUNNER_TEMP/dev"
          names=$(gh repo list bitbaum --limit 200 --no-archived --json name --jq '.[].name')
          [ -n "$names" ] || { echo "::error::no repos listed — the token cannot see the fleet"; exit 1; }
          n=0
          for name in $names; do
            if gh repo clone "bitbaum/$name" "$RUNNER_TEMP/dev/$name" -- \
                 --depth 1 --filter=blob:none --quiet 2>/dev/null; then
              n=$((n + 1))
            else
              echo "::warning::could not clone $name — it will not be audited"
            fi
          done
          echo "cloned $n repo(s)"
          echo "DEV_ROOT=$RUNNER_TEMP/dev" >> "$GITHUB_ENV"

      - name: No repo points at a hosted Supabase
        run: |
          set -uo pipefail
          {
            echo '## Hosted Supabase audit'
            echo
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"
          set +e
          bash scripts/ci/hosted-supabase-audit.sh --check 2>&1 | tee -a "$GITHUB_STEP_SUMMARY"
          rc=${PIPESTATUS[0]}
          set -e
          echo '```' >> "$GITHUB_STEP_SUMMARY"
          exit "$rc"