Infrastructure/migrate to astro db from suprabase and upstash

.cache/pages.json

@@ -22,16 +22,10 @@
   "contact",
   "offline",
   {
-    "privacy": [
-      "my-data"
-    ]
+    "privacy": ["my-data"]
   },
   {
-    "services": [
-      "consulting",
-      "overview",
-      "web-development"
-    ]
+    "services": ["consulting", "overview", "web-development"]
   },
   {
     "tags": [
@@ -53,4 +47,4 @@
       "typescript"
     ]
   }
-]
+]

.env.example

@@ -20,35 +20,6 @@ CRON_SECRET="local-cron-secret"
 RESEND_HTTP_PORT="9011"
 RESEND_API_KEY="mock-resend-key"
 
-# Upstash-compatible Redis mock for rate limits + cron keepalive keys (local
-# and on GitHub Actions, production on Vercel)
-UPSTASH_HTTP_PORT="8079"
-UPSTASH_REDIS_PORT="6380"
-UPSTASH_TOKEN="local-dev-token"
-
-# Vercel Marketplace Integration for Upstash Redis used with rate limiting on API endpoints
-# (local and on GitHub Actions, production on Vercel)
-KV_URL="redis://default:local-dev-token@127.0.0.1:6380"
-KV_REST_API_URL="http://127.0.0.1:8079"
-KV_REST_API_TOKEN="local-dev-token"
-KV_REST_API_READ_ONLY_TOKEN="local-dev-token"
-REDIS_URL="redis://default:local-dev-token@127.0.0.1:6380"
-
-# Supabase configuration
-# - SUPABASE_URL / SUPABASE_KEY: client + server runtime credentials used in Astro and API routes.
-# - SUPABASE_SERVICE_ROLE_KEY: server-side key for tests and cron endpoints (never expose to browser).
-# - SUPABASE_HEALTH_TIMEOUT: controls how long we wait for the local Supabase container to become healthy.
-# - SUPABASE_DB_PASSWORD / SUPABASE_PROJECT_REF / SUPABASE_ACCESS_TOKEN: only needed when pushing
-#   migrations to the hosted project (GitHub "build" workflow). Leave them empty locally unless you
-#   have production access.
-SUPABASE_HEALTH_TIMEOUT="240"
-SUPABASE_URL="http://127.0.0.1:54321"
-SUPABASE_KEY="sb_publishable_example"
-SUPABASE_SERVICE_ROLE_KEY="sb_secret_example"
-SUPABASE_DB_PASSWORD="example-db-password"
-SUPABASE_PROJECT_REF="exampleprojectref"
-SUPABASE_ACCESS_TOKEN="sbp_example_personal_access_token"
-
 # Observability / external services
 SENTRY_AUTH_TOKEN="dev-placeholder-sentry-token"
 SENTRY_DSN="https://examplePublicKey@o0.ingest.sentry.io/0"
@@ -60,3 +31,8 @@ VERCEL_ORG_ID="team_C7kQw5vXn0PfH3sJt2Gb9LrY"
 
 # Used for social shares on Mastodon
 WEBMENTION_IO_TOKEN="dev-webmention-token"
+
+# Astro DB - local file-backed dev database (token unused for file connections)
+ASTRO_DB_REMOTE_URL="file:./.astro/content.db"
+ASTRO_DB_APP_TOKEN=""
+# ASTRO_DATABASE_FILE must be exported in the shell (see README)

.github/workflows/branch-protection.yml

@@ -4,6 +4,9 @@ on:
   pull_request:
     types: [opened, edited, synchronize, reopened]
 
+permissions:
+  contents: read
+
 jobs:
   check-branch-name:
     name: Validate Branch Name

.github/workflows/build.yml

@@ -7,6 +7,9 @@ on:
     types:
       - completed
 
+permissions:
+  contents: read
+
 jobs:
   verify-ci:
     name: Verify CI Results
@@ -37,8 +40,8 @@ jobs:
               core.setFailed(`Required CI jobs missing or failed: ${missing.join(', ')}`);
             }
 
-  push-supabase-migrations:
-    name: Push Supabase Production Migrations
+  push-turso-migrations:
+    name: Push Turso Production Migrations
     runs-on: ubuntu-latest
     needs: verify-ci
     if: >-
@@ -53,15 +56,17 @@ jobs:
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
 
-      - name: Install Supabase CLI
-        uses: supabase/setup-cli@v1.6.0
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
         with:
-          version: latest
+          node-version: '22.x'
+          cache: 'npm'
 
-      - name: Link Supabase project
-        run: supabase link --project-ref ${{ secrets.SUPABASE_PROJECT_REF }} --password "${{ secrets.SUPABASE_DB_PASSWORD }}" --workdir suprabase
-        env:
-          SUPABASE_ACCESS_TOKEN: ${{ secrets.SUPABASE_ACCESS_TOKEN }}
+      - name: Install dependencies
+        run: npm ci --legacy-peer-deps
 
-      - name: Push migrations to production
-        run: supabase db push --workdir suprabase
+      - name: Push Astro DB migrations to Turso
+        run: npx astro db push --remote
+        env:
+          ASTRO_DB_REMOTE_URL: ${{ secrets.ASTRO_DB_REMOTE_URL }}
+          ASTRO_DB_APP_TOKEN: ${{ secrets.ASTRO_DB_APP_TOKEN }}

.github/workflows/ping-turso.yml

@@ -0,0 +1,52 @@
+name: Ping Turso
+
+on:
+  schedule:
+    - cron: '*/30 * * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ping-turso
+  cancel-in-progress: true
+
+jobs:
+  ping:
+    name: Ping Turso Production DB
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v6
+        with:
+          node-version: '22.x'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci --legacy-peer-deps
+
+      - name: Execute keep-alive query
+        env:
+          ASTRO_DB_REMOTE_URL: ${{ secrets.ASTRO_DB_REMOTE_URL }}
+          ASTRO_DB_APP_TOKEN: ${{ secrets.ASTRO_DB_APP_TOKEN }}
+        run: |
+          node --input-type=module -e "\
+          import { createClient } from '@libsql/client';\
+          const url = process.env.ASTRO_DB_REMOTE_URL;\
+          const authToken = process.env.ASTRO_DB_APP_TOKEN;\
+          if (!url || !authToken) {\
+            throw new Error('Missing ASTRO_DB_REMOTE_URL or ASTRO_DB_APP_TOKEN');\
+          }\
+          const client = createClient({ url, authToken });\
+          try {\
+            await client.execute('SELECT 1');\
+            console.log('[ping-turso] OK');\
+          } finally {\
+            client.close();\
+          }\
+          "