feat: add supabase module for CLI installation and auth

[DevelopmentCats]

This PR adds a new supabase module that installs the Supabase CLI and configures authentication in Coder workspaces.

Features

• Multi-platform installation: Supports Linux (deb/rpm/apk/binary), macOS (brew/binary), and Windows (scoop)
• Multi-architecture: Works on both amd64 and arm64
• Flexible authentication:
  • OAuth via Coder external auth (use_external_auth = true)
  • Personal access token (access_token variable)
• Dashboard app: Adds a workspace app linking to Supabase dashboard
• Project linking: When project_ref is provided, automatically runs supabase link to connect the CLI to your project

Usage

Basic usage with PAT:

module "supabase" {
  source       = "registry.coder.com/coder/supabase/coder"
  version      = "1.0.0"
  agent_id     = coder_agent.main.id
  access_token = var.supabase_token
}

With OAuth and project linking:

module "supabase" {
  source            = "registry.coder.com/coder/supabase/coder"
  version           = "1.0.0"
  agent_id          = coder_agent.main.id
  use_external_auth = true
  project_ref       = "your-project-ref"
  project_dir       = "/home/coder/my-app"
}

Testing

• 15 Terraform tests covering all variables and resource configurations
• Manually tested on a Coder deployment with both PAT and OAuth authentication methods
• Verified CLI installation, authentication, dashboard app, and project linking functionality

[github-actions]

Module Scorecard Check

coder/supabase: first scorecard, 89 / 100

No existing scorecard discussion found for Supabase CLI; this is the initial score. A dedicated discussion is created after merge.

Full scorecard for this PR

| Presentation & Onboarding | Credential Hygiene | Restricted-Environment Readiness | Engineering Quality | Overall |
|---:|---:|---:|---:|---:|---:|
| 17 / 25 | 20 / 20 | 20 / 20 | 10 / 10 | 89 / 100 |

Drilldown

Presentation & Onboarding — 17 / 25

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides examples for both authentication modes (personal access token and external auth), custom install methods, pre-installed binary, internal mirror, and project dashboard link. Each major configuration path is documented with sensible defaults.
Coder-context framing	8	5	README explains what the module adds ("Install Supabase CLI and configure authentication via Coder external auth or access token") and mentions Coder's external auth integration. However, the framing is somewhat generic and doesn't clearly articulate where Coder fits in the developer workflow beyond "handles installation and injects credentials." The "What this module does" section repeats information rather than clarifying the Coder-specific value proposition.
Visual preview	5	0	No image, GIF, or video in the README. Only an icon reference in frontmatter.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	access_token and db_password variables are marked sensitive = true in main.tf. README examples use var.supabase_token references and include a NOTE admonishing "Never hardcode tokens in your template." No inline secrets in examples.
Non-hardcoded auth path	4	4	README documents Coder external auth (OAuth) as the primary authentication method with detailed setup instructions including environment variables and OAuth app creation. This avoids pasting raw keys into templates.

Restricted-Environment Readiness — 20 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	10	10	download_base_url variable (default: "https://github.com/supabase/cli/releases/download") overrides the CLI download URL. README includes example: "With Internal Mirror" showing download_base_url = "https://artifacts.internal.corp/supabase-cli/releases/download". The install script uses this variable in the download path construction.
Bring-your-own binary	5	5	skip_install boolean variable documented with example "Pre-installed Binary (Air-gapped / Golden Image)" showing skip_install = true with comment "CLI is already in the image". The install script checks this flag and skips installation while still configuring auth.
Egress transparency	3	3	Dedicated "Network Egress" README section enumerates external endpoints with table showing endpoint, purpose, and when contacted: api.github.com, github.com, api.supabase.com, supabase.com, and Homebrew/Scoop repos. Includes note for restricted environments: "set download_base_url to an internal mirror or use skip_install = true".
Runs without sudo	2	2	Install script (install.sh.tftpl) attempts sudo for package managers (dpkg, rpm, apk) but includes fallback logic: `

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All inputs have clear descriptions. Sensible defaults: install_method = "detect", supabase_version = "latest", use_external_auth = false, dashboard_app = true. Validation on install_method ensures only valid values (detect, brew, scoop, binary). Sensitive inputs properly marked.
Test coverage	4	4	Comprehensive .tftest.hcl with 20+ test runs covering basic config, auth methods, install methods, version pinning, skip_install, custom URLs, app creation, and edge cases. TypeScript tests (main.test.ts) cover end-to-end behavior including container-based install verification on Ubuntu and Debian, install method detection, symlink creation, and script content validation. Tests verify both Terraform logic and runtime behavior.

Overall — 89 / 100

Raw 67 / 75 → round(67 / 75 × 100) = 89

Track: Utility (CLI tool helper, not an agent or IDE)

---

Scored against SCORECARD.md with claude-sonnet-4-5. Language-model scores are advisory.

[Copilot]

Pull request overview

Adds a new registry/coder/modules/supabase Terraform module for Coder workspaces that installs the Supabase CLI, configures authentication (PAT or Coder external auth), optionally links a project, and exposes a dashboard app.

Changes:

• Introduces a multi-platform Supabase CLI install script (detect/brew/scoop/native/binary) with optional supabase link.
• Adds Terraform module resources for env vars (SUPABASE_ACCESS_TOKEN, SUPABASE_DB_PASSWORD) and an optional Supabase dashboard coder_app.
• Adds Terraform and Bun test coverage plus a new Supabase icon asset.

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
registry/coder/modules/supabase/scripts/install.sh.tftpl	Bash installer for Supabase CLI with platform detection and optional project linking.
registry/coder/modules/supabase/main.tf	Module inputs/outputs, external-auth integration, coder-utils orchestration, env vars, and dashboard app.
registry/coder/modules/supabase/README.md	Module documentation, usage examples, and operational notes (auth, dashboard app, logs).
registry/coder/modules/supabase/main.tftest.hcl	Terraform tests validating defaults and resource configuration.
registry/coder/modules/supabase/main.test.ts	Bun tests for module variable validation and container-based install verification.
.icons/supabase.svg	Adds Supabase icon for module/app presentation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[bpmct]

LGTM. Seems like a very solid module