supabase / cli / 37609748464
67%
develop: 67%

LAST BUILD BRANCH: gh-readonly-queue/develop/pr-7205-c246e1e662911ab35e3f3d9927bb07b0601fcaf3
DEFAULT BRANCH: develop
Ran
Jobs 1
Files 79
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 66.737%. Remained the same
37609748464

push

github

web-flow 
fix(ci): require write access for fast-forward approvals (#7035)

## Summary

The `fast-forward` job in `release.yml` fast-forwards `main` to
`develop` whenever an approving review is submitted on the develop →
main deploy PR, but it never checks who approved. On a public repo any
GitHub user can leave an approving review, so a drive-by approval on the
weekly "chore: production deploy" PR would fast-forward `main` and cut a
stable release.

The job now looks up the reviewer's repo permission first (`GET
/repos/{owner}/{repo}/collaborators/{username}/permission`, checking
both `permission` and `role_name`) and only mints the App token, checks
out and fast-forwards when it's `admin`, `maintain` or `write`. Anyone
else gets a `::notice::` and a green skip rather than a red run.
Maintainer approvals behave exactly as before.

While there, the head SHA moved out of the inline `run:` script into
`env:`.

Split out of CLI-2630 so it doesn't wait on the larger branching/release
PR, which also generalises this job.

## Linked issue

Linear: CLI-2630

- [x] The linked issue is **open** and carries the
`open-for-contribution` label (or I'm a Supabase maintainer).

## Checklist

- [x] The PR title follows [Conventional
Commits](https://www.conventionalcommits.org/) (e.g. `fix(cli): …`).
- [ ] Tests added or updated for the change. (Workflow-only change;
validated with `actionlint`. The permission lookup gets its first live
run on the next deploy PR approval, and fails closed if the lookup
errors.)
- [x] From the repository root, `pnpm check:all` passes; relevant
package tests pass for every touched workspace, and `pnpm types:check`
passes for each touched TypeScript workspace (or workspace declaring
it).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

4097 of 6139 relevant lines covered (66.74%)

7.37 hits per line

Jobs
ID Job ID Ran Files Coverage
1 37609748464.1 79
66.74
GitHub Action Run
Source Files on build 37609748464