supabase / cli / 30282166957
65%

DEFAULT BRANCH: develop
Ran
Jobs 1
Files 230
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 65.288% (-0.001%) from 65.289%
30282166957

push

github

web-flow 
fix(cli): resolve CodeQL and Go codegen CI failures blocking #5874 (#5957)

## What kind of change does this PR introduce?

Bug fix / CI fix.

## What is the current behavior?

Two checks are failing on #5874 (the `develop`→`main` production-deploy
rollup PR, which tracks whatever's on `develop` and can't be fixed
directly):

- **CodeQL** flags `js/incomplete-url-substring-sanitization` on a test
assertion in `start.integration.test.ts` that uses
`.includes("registry.example.com")` to check a spawned docker arg — a
false positive, but a real CodeQL pattern match.
- **Codegen** (`apps/cli-go`) fails outright: `kin-openapi` v0.135.0
can't parse the live Management API spec anymore (one schema now uses
OpenAPI-3.1-style numeric `exclusiveMinimum` instead of the 3.0 boolean
form), and separately `api/overlay.yaml` has drifted from the current
spec shape (several `oneOf`→`anyOf` renames, dropped discriminators, a
couple of new null-typed deprecated fields, and a query param union
oapi-codegen can't represent).

## What is the new behavior?

- Tightened the test assertion to
`.startsWith("registry.example.com/supabase/")`, which resolves the
CodeQL pattern and is also a stricter, more correct check.
- Bumped `kin-openapi` to v0.136.0 (pulls `go.mod`'s `go` directive to
1.26) and updated `api/overlay.yaml`'s selectors/actions to match the
current live spec. Regenerated `pkg/api/{types,client}.gen.go` and
updated the handful of call sites affected by resulting type/name
changes (a few query params flipped bool→string upstream; the SMS
provider enum lost a per-schema prefix after oapi-codegen deduped it).
- Replaced deprecated `ecdsa.PublicKey.X/Y`/`PrivateKey.D` field access
in the JWT signing-key code with the new
`Bytes()`/`ParseUncompressedPublicKey` APIs, since Go 1.26 flags the old
fields and would otherwise have regressed the (currently passing) Lint
check.

Once merged, #5874 should pick these fixes up automatically since it
tracks `develop`'s HEAD.

11257 of 17242 relevant lines covered (65.29%)

10.5 hits per line

Coverage Regressions

Lines Coverage ∆ File
9
90.3
 -2.38% internal/gen/signingkeys/signingkeys.go
Jobs
ID Job ID Ran Files Coverage
1 30282166957.1 230
65.29
 GitHub Action Run
Source Files on build 30282166957