ci: bump supabase/sdk reusable workflows to v1.3.0 - #1780
Merged
Conversation
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review. 📝 WalkthroughWalkthroughBoth GitHub Actions workflows now reference compliance workflow version ChangesCompliance workflow updates
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to This localized workflow-version update aligns the referenced compliance workflows with the SDK repository layout, with no actionable merge-blocking risk remaining after normal checks and review. Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Full details: Docstring CoverageExplanation No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.) ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
QuintinWillison
approved these changes
Aug 28, 2026
spydon
added a commit
to supabase/sdk
that referenced
this pull request
Aug 28, 2026
##⚠️ Do not merge until all four caller bump PRs are merged This PR removes the compatibility layer that pinned callers depend on. Merging it early breaks the compliance check on any SDK repo that has not yet bumped. | Repo | Bump PR | Status | | --- | --- | --- | | supabase-flutter | supabase/supabase-flutter#1780 | open, CI green | | supabase-swift | supabase/supabase-swift#1297 | open, CI green | | supabase-js | supabase/supabase-js#2636 | open, CI green | | supabase-py | supabase/supabase-py#1595 | open, CI green | `supabase-go` already tracks `@main` and needs nothing. ## What Removes the two transitional symlinks left behind by the `packages/` restructure (#93): ``` scripts/capability-matrix -> ../packages/capability-matrix scripts/dart_symbol_extractor -> ../packages/dart-symbol-extractor ``` With both gone, `scripts/` is empty and disappears. Follow-on cleanup of the same concept: - **`README.md`** — drops the `scripts/` entry from the repository layout block. - **`CLAUDE.md`** — drops the paragraph explaining the symlinks and when to remove them. - **`sdk-ref` input descriptions** (5 reusable workflows + 2 composite actions) — reworded from "Ref to checkout from supabase/sdk for scripts" to "... for tooling", since `scripts` no longer names anything. Description-only, not part of the call contract. Easy to drop from this PR if you would rather keep the diff to the symlinks alone. ## Why the symlinks existed Pinning to these reusable workflows is not fully hermetic: the pinned workflow body comes from the tag, but the composite actions it calls are referenced `@main` and check out this repo at `main`. After the restructure, a caller pinned to `v1.2.0` therefore combined a post-restructure checkout with a workflow body still hardcoding `_sdk-spec/scripts/...`. The symlinks bridged exactly that gap. `v1.3.0` was cut (#97, #98) to give callers a post-restructure ref to pin to, which is what the four PRs above do. ## Verification - `npm run validate` — OK - `npm test` — 195 passed (14 files) - `npm run typecheck` — clean - `git grep "scripts/"` — no matches anywhere in the repo The four caller PRs are the real proof: each one's own compliance run resolves the `packages/` paths against a `main` checkout, and all four passed. ## Note for later This class of breakage recurs whenever a path referenced by a pinned workflow body moves, because the composite actions float on `@main`. Pinning the `sdk-compliance-*` action refs alongside the workflow ref, or having the workflows resolve tooling paths dynamically, would make pinning actually hermetic. Out of scope here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Bumps the pinned
supabase/sdkreusable workflow ref fromv1.2.0tov1.3.0, in bothvalidate-capabilities.ymlandsync-compliance.yml.Why
supabase/sdkwas restructured into apackages/monorepo layout (supabase/sdk#93), movingscripts/capability-matrixtopackages/capability-matrixandscripts/dart_symbol_extractortopackages/dart-symbol-extractor.Pinning there is not fully hermetic: the pinned workflow body comes from the tag, but the composite actions it calls are referenced
@mainand check outsupabase/sdkatmain. So onv1.2.0we get a post-restructure checkout combined with a workflow body that still hardcodes_sdk-spec/scripts/.... That only works today becausesupabase/sdkcarries transitionalscripts/→packages/symlinks, which are there purely for pinned callers like this one and are meant to be deleted.Bumping to
v1.3.0puts the workflow body and the checked-out layout back in agreement, and lets those symlinks be removed upstream.Risk
Low. Between
v1.2.0andv1.3.0the reusable workflows changed only in thesescripts/→packages/paths. No input was added, removed, renamed, or given a new default, so this is a pure ref bump with no call-site changes needed.Worth confirming the compliance check job goes green here before merge, since that is the actual thing being verified.
Summary by CodeRabbit