supabase / cli / 30300332852
65%
develop: 65%

LAST BUILD BRANCH: gh-readonly-queue/develop/pr-6014-14c7b44c0b8a7bd4f7804e0576a0c74f6ff45df4
DEFAULT BRANCH: develop
Ran
Jobs 1
Files 230
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 65.288%. Remained the same
30300332852

push

github

web-flow 
fix(cli): gate vanity-subdomains and network-restrictions behind --experimental (CLI-1972) (#5945)

## Current Behavior

Go registers `vanityCmd` and `restrictionsCmd` (alongside `bansCmd`) as
experimental (`apps/cli-go/cmd/root.go:56-65`) and refuses them in
`PersistentPreRunE` with exit 1 and `must set the --experimental flag to
run this command` — before login, ref resolution, telemetry, or any API
call (`root.go:91-96`).

The TS legacy shell only reproduced this gate for `network-bans`.
`vanity-subdomains get|check-availability|activate|delete` and
`network-restrictions get|update` had zero gate calls: they ran to
completion without `--experimental` — API call made, exit 0,
`cli_command_executed` fired, `linked-project.json` written — where Go
does none of that.

## Expected Behavior

All six leaves now fail with Go's exact gate message (exit 1) unless
`--experimental` or `SUPABASE_EXPERIMENTAL` is set, with no API call, no
telemetry event, and no `linked-project.json`/`telemetry.json` write
behind a closed gate.

The wiring mirrors the merged CLI-1854 precedent (#5766) and the in-repo
`network-bans` reference exactly:

- `legacyValidateOutputFormat(LEGACY_RESOURCE_OUTPUT_FORMATS)` runs
first, so an invalid `-o` value still wins over a missing
`--experimental` (cobra enum-validates root's persistent `-o` at parse
time, before `PersistentPreRunE`).
- `legacyRequireExperimental` runs next, before any instrumentation or
layer work.
- `legacyManagementApiRuntimeLayer` moves from `Command.provide` to an
inline `Effect.provide` after the gate — `Command.provide` builds the
layer (and eagerly resolves an access token) before the handler's first
yield, which would let a missing-token error mask the gate error,
exactly the failure mode CLI-1854 fixed for the other three families.

New gate integration suites for both families mirror
`network-bans.experimental-gate.integration.test.ts`: a closed gate
fails with `LegacyExperimentalRequiredError` and zero API... (continued)

11257 of 17242 relevant lines covered (65.29%)

10.51 hits per line

Jobs
ID Job ID Ran Files Coverage
1 30300332852.1 230
65.29
 GitHub Action Run
Source Files on build 30300332852