Merge branch 'develop' into fix/ltree-extension-search-path

7ttp · web-flow · commit 8cc481ed5792 · 2025-11-26T12:41:04.000+05:30
diff --git a/.github/workflows/api-sync.yml b/.github/workflows/api-sync.yml
@@ -36,12 +36,19 @@ jobs:
             echo "has_changes=true" >> $GITHUB_OUTPUT
           fi
 
+      - name: Generate token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
       - name: Create Pull Request
         if: steps.check.outputs.has_changes == 'true'
         id: cpr
         uses: peter-evans/create-pull-request@v7
         with:
-          token: ${{ secrets.GH_PAT }}
+          token: ${{ steps.app-token.outputs.token }}
           commit-message: "chore: sync API types from infrastructure"
           title: "chore: sync API types from infrastructure"
           body: |
@@ -58,4 +65,4 @@ jobs:
         if: steps.check.outputs.has_changes == 'true'
         run: gh pr merge --auto --squash "${{ steps.cpr.outputs.pull-request-number }}"
         env:
-          GH_TOKEN: ${{ secrets.GH_PAT }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
@@ -22,17 +22,24 @@ jobs:
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 
+      - name: Generate token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+
       # Here the PR gets approved.
       - name: Approve a PR
         if: ${{ steps.meta.outputs.update-type == 'version-update:semver-patch' || (!startsWith(steps.meta.outputs.previous-version, '0.') && steps.meta.outputs.update-type == 'version-update:semver-minor') }}
         run: gh pr review --approve "${{ github.event.pull_request.html_url }}"
         env:
-          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
 
       # Finally, this sets the PR to allow auto-merging for patch and minor
       # updates if all checks pass
       - name: Enable auto-merge for Dependabot PRs
         if: ${{ steps.meta.outputs.update-type == 'version-update:semver-patch' || (!startsWith(steps.meta.outputs.previous-version, '0.') && steps.meta.outputs.update-type == 'version-update:semver-minor') }}
         run: gh pr merge --auto --squash "${{ github.event.pull_request.html_url }}"
         env:
-          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
diff --git a/.github/workflows/release-beta.yml b/.github/workflows/release-beta.yml
@@ -70,9 +70,21 @@ jobs:
         with:
           go-version-file: go.mod
           cache: true
+      # use GitHub app to create a release token that can publish to homebrew-tap and scoop
+      - name: Generate token
+        id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: |
+            cli
+            homebrew-tap
+            scoop-bucket
       - run: go run tools/publish/main.go --beta "${{ needs.release.outputs.new-release-version }}"
         env:
-          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
 
   publish:
     name: Publish NPM
@@ -85,9 +97,7 @@ jobs:
       - uses: actions/checkout@v6
       - uses: actions/setup-node@v6
         with:
-          node-version: "16.x"
-          registry-url: "https://registry.npmjs.org"
+          node-version: latest
+          registry-url: https://registry.npmjs.org
       - run: npm --git-tag-version=false version ${{ needs.release.outputs.new-release-version }}
       - run: npm publish --tag ${{ needs.release.outputs.new-release-channel }}
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -17,13 +17,25 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     outputs:
       release_tag: ${{ steps.prerelease.outputs.tagName }}
+      app_token: ${{ steps.app-token.outputs.token }}
     steps:
       - uses: actions/checkout@v6
       - id: prerelease
         run: |
           gh release list --limit 1 --json tagName --jq \
           '.[]|to_entries|map("\(.key)=\(.value|tostring)")|.[]' >> $GITHUB_OUTPUT
       - run: gh release edit ${{ steps.prerelease.outputs.tagName }} --latest --prerelease=false
+      - id: app-token
+        uses: actions/create-github-app-token@v2
+        with:
+          app-id: ${{ secrets.APP_ID }}
+          private-key: ${{ secrets.GH_APP_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: |
+            cli
+            homebrew-tap
+            scoop-bucket
+            supabase
 
   commit:
     name: Publish Brew and Scoop
@@ -38,7 +50,7 @@ jobs:
           cache: true
       - run: go run tools/publish/main.go ${{ needs.settings.outputs.release_tag }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
+          GITHUB_TOKEN: ${{ needs.settings.outputs.app_token }}
 
   publish:
     name: Publish NPM
@@ -51,6 +63,8 @@ jobs:
 
   compose:
     name: Bump self-hosted versions
+    needs:
+      - settings
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
@@ -60,11 +74,12 @@ jobs:
           cache: true
       - run: go run tools/selfhost/main.go
         env:
-          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
+          GITHUB_TOKEN: ${{ needs.settings.outputs.app_token }}
 
   changelog:
     name: Publish changelog
     needs:
+      - settings
       - commit
       - publish
     runs-on: ubuntu-latest
@@ -76,7 +91,7 @@ jobs:
           cache: true
       - run: go run tools/changelog/main.go ${{ secrets.SLACK_CHANNEL }}
         env:
-          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
+          GITHUB_TOKEN: ${{ needs.settings.outputs.app_token }}
           SLACK_TOKEN: ${{ secrets.SLACK_TOKEN }}
 
   docs:
@@ -92,4 +107,4 @@ jobs:
           cache: true
       - run: go run docs/main.go ${{ needs.settings.outputs.release_tag }} | go run tools/bumpdoc/main.go apps/docs/spec/cli_v1_commands.yaml
         env:
-          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
+          GITHUB_TOKEN: ${{ needs.settings.outputs.app_token }}
diff --git a/.github/workflows/tag-npm.yml b/.github/workflows/tag-npm.yml
@@ -15,18 +15,20 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   tag:
     name: Move latest tag
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
+
       - uses: actions/setup-node@v6
         with:
-          node-version: "16.x"
-          registry-url: "https://registry.npmjs.org"
+          node-version: latest
+          registry-url: https://registry.npmjs.org
+
       - run: npm dist-tag add "supabase@${RELEASE_TAG#v}" latest
         env:
           RELEASE_TAG: ${{ inputs.release }}
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/pkg/config/templates/Dockerfile b/pkg/config/templates/Dockerfile
@@ -5,15 +5,15 @@ FROM library/kong:2.8.1 AS kong
 FROM axllent/mailpit:v1.22.3 AS mailpit
 FROM postgrest/postgrest:v13.0.7 AS postgrest
 FROM supabase/postgres-meta:v0.93.1 AS pgmeta
-FROM supabase/studio:2025.11.24-sha-d990ae8 AS studio
+FROM supabase/studio:2025.11.25-sha-8de52c4 AS studio
 FROM darthsim/imgproxy:v3.8.0 AS imgproxy
 FROM supabase/edge-runtime:v1.69.25 AS edgeruntime
 FROM timberio/vector:0.28.1-alpine AS vector
 FROM supabase/supavisor:2.7.4 AS supavisor
 FROM supabase/gotrue:v2.183.0 AS gotrue
-FROM supabase/realtime:v2.65.2 AS realtime
+FROM supabase/realtime:v2.65.3 AS realtime
 FROM supabase/storage-api:v1.32.0 AS storage
-FROM supabase/logflare:1.26.12 AS logflare
+FROM supabase/logflare:1.26.13 AS logflare
 # Append to JobImages when adding new dependencies below
 FROM supabase/pgadmin-schema-diff:cli-0.0.5 AS differ
 FROM supabase/migra:3.0.1663481299 AS migra
diff --git a/pkg/config/updater_test.go b/pkg/config/updater_test.go
@@ -224,14 +224,22 @@ func TestUpdateStorageConfig(t *testing.T) {
 			FileSizeLimit: 100,
 			Features: struct {
 				IcebergCatalog *struct {
-					Enabled bool `json:"enabled"`
+					Enabled       bool `json:"enabled"`
+					MaxCatalogs   int  `json:"maxCatalogs"`
+					MaxNamespaces int  `json:"maxNamespaces"`
+					MaxTables     int  `json:"maxTables"`
 				} `json:"icebergCatalog,omitempty"`
 				ImageTransformation struct {
 					Enabled bool `json:"enabled"`
 				} `json:"imageTransformation"`
 				S3Protocol struct {
 					Enabled bool `json:"enabled"`
 				} `json:"s3Protocol"`
+				VectorBuckets *struct {
+					Enabled    bool `json:"enabled"`
+					MaxBuckets int  `json:"maxBuckets"`
+					MaxIndexes int  `json:"maxIndexes"`
+				} `json:"vectorBuckets,omitempty"`
 			}{},
 		}
 		mockStorage.Features.ImageTransformation.Enabled = true
