fix(cli): resolve CodeQL and Go codegen CI failures blocking #5874 - #5957
Merged
Conversation
…positive
Anchor the check with a path-separated prefix (.startsWith("registry.example.com/supabase/"))
instead of a bare substring match, since CodeQL's incomplete-url-substring-sanitization
query otherwise flags .includes() as an incomplete host check.
…I spec
kin-openapi v0.135.0 can't parse the live spec anymore: one schema now uses
OpenAPI 3.1-style numeric exclusiveMinimum instead of the 3.0 boolean form.
Bump to v0.136.0 (requires go 1.26) which handles both.
api/overlay.yaml had also drifted from the current spec shape: several
unions moved from oneOf to anyOf, some schemas dropped their discriminator
entirely, two new null-typed deprecated fields appeared on
V1CreateProjectBody, and the `services` query param gained a
comma-string-or-array union oapi-codegen can't represent. Update the
overlay's selectors and actions to match.
Regenerate pkg/api/{types,client}.gen.go and fix call sites for the
resulting renamed/retyped generated fields: several boolean query params
(force, reveal, verify_jwt, bundleOnly) flipped to string upstream, and the
SMS provider enum lost its per-schema prefix on UpdateAuthConfigBody after
oapi-codegen deduped it against an identical enum on AuthConfigResponse.
Also replace deprecated ecdsa.PublicKey.X/Y and PrivateKey.D field access
with PublicKey.Bytes()/PrivateKey.Bytes()/ParseUncompressedPublicKey, since
Go 1.26 flags the old fields (SA1019) and the go.mod bump above would
otherwise regress the Lint check.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b2bb0db54e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Contributor
Supabase CLI previewnpx --yes https://pkg.pr.new/supabase/cli/supabase@3211530cefd203f8d38b1c6c9b2b7a283e8ab539Preview package for commit |
apps/cli-go/go.mod's `go` directive was bumped to 1.26 (kin-openapi fix), but mise.toml still pinned 1.25.11 — mise-managed setup/lint/release jobs would fall back to an implicit secondary toolchain download, which fails outright in restricted/offline environments or under GOTOOLCHAIN=local. Pin mise to 1.26.5 (latest patch) and refresh mise.lock checksums/URLs for all platforms. review: PRRT_kwDOErm0O86UDpTD
jgoux
approved these changes
Jul 27, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What kind of change does this PR introduce?
Bug fix / CI fix.
What is the current behavior?
Two checks are failing on #5874 (the
develop→mainproduction-deploy rollup PR, which tracks whatever's ondevelopand can't be fixed directly):js/incomplete-url-substring-sanitizationon a test assertion instart.integration.test.tsthat uses.includes("registry.example.com")to check a spawned docker arg — a false positive, but a real CodeQL pattern match.apps/cli-go) fails outright:kin-openapiv0.135.0 can't parse the live Management API spec anymore (one schema now uses OpenAPI-3.1-style numericexclusiveMinimuminstead of the 3.0 boolean form), and separatelyapi/overlay.yamlhas drifted from the current spec shape (severaloneOf→anyOfrenames, dropped discriminators, a couple of new null-typed deprecated fields, and a query param union oapi-codegen can't represent).What is the new behavior?
.startsWith("registry.example.com/supabase/"), which resolves the CodeQL pattern and is also a stricter, more correct check.kin-openapito v0.136.0 (pullsgo.mod'sgodirective to 1.26) and updatedapi/overlay.yaml's selectors/actions to match the current live spec. Regeneratedpkg/api/{types,client}.gen.goand updated the handful of call sites affected by resulting type/name changes (a few query params flipped bool→string upstream; the SMS provider enum lost a per-schema prefix after oapi-codegen deduped it).ecdsa.PublicKey.X/Y/PrivateKey.Dfield access in the JWT signing-key code with the newBytes()/ParseUncompressedPublicKeyAPIs, since Go 1.26 flags the old fields and would otherwise have regressed the (currently passing) Lint check.Once merged, #5874 should pick these fixes up automatically since it tracks
develop's HEAD.