fix(cli): resolve CodeQL and Go codegen CI failures blocking #5874

apps/cli-go/api/overlay.yaml

@@ -14,13 +14,13 @@ actions:
       - abcdefghijklmnopqrstuvwxyz:ABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789
       - abcdefghijklmnopqrstuvwxyz:ABCDEFGHIJKLMNOPQRSTUVWXYZ:0123456789:!@#$%^&*()_+-=[]{};'\\\\:\"|<>?,./`~
       - ''
-- target: $.components.schemas.*.properties.attribute_mapping.properties.keys.additionalProperties.properties.default.oneOf
+- target: $.components.schemas.*.properties.attribute_mapping.properties.keys.additionalProperties.properties.default.anyOf
   description: Replaces request union type with interface for easier casting
   remove: true
-- target: $.components.schemas.*.properties.saml.properties.attribute_mapping.properties.keys.additionalProperties.properties.default.oneOf
+- target: $.components.schemas.*.properties.saml.properties.attribute_mapping.properties.keys.additionalProperties.properties.default.anyOf
   description: Replaces response union type with interface for easier casting
   remove: true
-- target: $.components.schemas.*.properties.items.items.properties.saml.properties.attribute_mapping.properties.keys.additionalProperties.properties.default.oneOf
+- target: $.components.schemas.*.properties.items.items.properties.saml.properties.attribute_mapping.properties.keys.additionalProperties.properties.default.anyOf
   description: Replaces list union type with interface for easier casting
   remove: true
 - target: $.components.schemas.*.properties.saml.properties.name_id_format.enum
@@ -32,39 +32,48 @@ actions:
 - target: $.components.schemas.*.properties.connectionString
   description: Removes deprecated field that conflicts with naming convention
   remove: true
-- target: $.components.schemas.*.properties.region_selection.discriminator
-  description: Replaces discriminated union with concrete type
+- target: $.components.schemas.V1CreateProjectBody.properties.release_channel
+  description: Removes deprecated null-only field that oapi-codegen cannot map
   remove: true
-- target: $.components.schemas.*.properties.private_jwk.discriminator
-  description: Replaces discriminated union with concrete type
+- target: $.components.schemas.V1CreateProjectBody.properties.postgres_engine
+  description: Removes deprecated null-only field that oapi-codegen cannot map
   remove: true
-- target: $.components.schemas.DiskRequestBody.properties.attributes.discriminator
-  description: Replaces discriminated union with concrete type
-  remove: true
-- target: $.components.schemas.JitStateResponse.discriminator
-  description: Replaces discriminated union with concrete type
-  remove: true
-- target: $.components.schemas.JitListAccessResponse.properties.items.items.oneOf[0].properties.invite_id
+- target: $.components.schemas.JitListAccessResponse.properties.items.items.anyOf[0].properties.invite_id
   description: Replaces null-only project user invite id with nullable UUID for oapi-codegen
   update:
     type: string
     format: uuid
     nullable: true
-- target: $.components.schemas.JitListAccessResponse.properties.items.items.oneOf[0].properties.expires_at
+- target: $.components.schemas.JitListAccessResponse.properties.items.items.anyOf[0].properties.expires_at
   description: Replaces null-only project user invite expiry with nullable string for oapi-codegen
   update:
     type: string
     nullable: true
-- target: $.components.schemas.JitListAccessResponse.properties.items.items.oneOf[1].properties.user_id
+- target: $.components.schemas.JitListAccessResponse.properties.items.items.anyOf[1].properties.user_id
   description: Replaces null-only invited user id with nullable UUID for oapi-codegen
   update:
     type: string
     format: uuid
     nullable: true
-- target: $.components.schemas.ProjectUpgradeEligibilityResponse.properties.warnings.items.discriminator
-  description: Removes inline warning discriminator that oapi-codegen cannot map
-  remove: true
 - target: $.paths.*.*.parameters[?(@.name=='branch_id_or_ref')]
   update:
     schema:
       type: string
+- target: $.paths.*.*.parameters[?(@.name=='services')].schema.anyOf
+  description: Removes comma-string-or-array union so the array-of-enum shape can be set directly
+  remove: true
+- target: $.paths.*.*.parameters[?(@.name=='services')].schema
+  description: Replaces comma-string-or-array union with a plain array of enums for oapi-codegen
+  update:
+    type: array
+    items:
+      type: string
+      enum:
+        - auth
+        - db
+        - db_postgres_user
+        - pooler
+        - realtime
+        - rest
+        - storage
+        - pg_bouncer

apps/cli-go/go.mod

@@ -1,6 +1,6 @@
 module github.com/supabase/cli
 
-go 1.25.11
+go 1.26
 
 require (
 	github.com/BurntSushi/toml v1.6.0
@@ -189,7 +189,7 @@ require (
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
 	github.com/fzipp/gocyclo v0.6.0 // indirect
 	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
-	github.com/getkin/kin-openapi v0.135.0 // indirect
+	github.com/getkin/kin-openapi v0.136.0 // indirect
 	github.com/ghostiam/protogetter v0.3.20 // indirect
 	github.com/go-critic/go-critic v0.14.3 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
@@ -353,7 +353,7 @@ require (
 	github.com/oapi-codegen/oapi-codegen/v2 v2.7.1 // indirect
 	github.com/oapi-codegen/runtime v1.6.0 // indirect
 	github.com/oasdiff/yaml v0.0.9 // indirect
-	github.com/oasdiff/yaml3 v0.0.9 // indirect
+	github.com/oasdiff/yaml3 v0.0.12 // indirect
 	github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 // indirect
 	github.com/olekukonko/errors v1.2.0 // indirect
 	github.com/olekukonko/ll v0.1.6 // indirect

apps/cli-go/go.sum

@@ -371,8 +371,8 @@ github.com/fzipp/gocyclo v0.6.0 h1:lsblElZG7d3ALtGMx9fmxeTKZaLLpU8mET09yN4BBLo=
 github.com/fzipp/gocyclo v0.6.0/go.mod h1:rXPyn8fnlpa0R2csP/31uerbiVBugk5whMdlyaLkLoA=
 github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
 github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
-github.com/getkin/kin-openapi v0.135.0 h1:751SjYfbiwqukYuVjwYEIKNfrSwS5YpA7DZnKSwQgtg=
-github.com/getkin/kin-openapi v0.135.0/go.mod h1:6dd5FJl6RdX4usBtFBaQhk9q62Yb2J0Mk5IhUO/QqFI=
+github.com/getkin/kin-openapi v0.136.0 h1:mJC/W0ZFnwGYkUUwujw+LmWGFuKcqHklJjpl8JAH5eE=
+github.com/getkin/kin-openapi v0.136.0/go.mod h1:f97ss9nLJZRi9fm0vSwKZa4KrPMltWnZf9peal6MBrs=
 github.com/getsentry/sentry-go v0.48.0 h1:FRZNr7Uk1C86ev1bSJmYlUkL9oyivQA6YOcdYfaaMmY=
 github.com/getsentry/sentry-go v0.48.0/go.mod h1:E5UkA5wp1qR2+MDydNYlVeUiNN2xEdjYMidkgf0Qoss=
 github.com/ghostiam/protogetter v0.3.20 h1:oW7OPFit2FxZOpmMRPP9FffU4uUpfeE/rEdE1f+MzD0=
@@ -900,8 +900,8 @@ github.com/oapi-codegen/runtime v1.6.0 h1:7Xx+GlueD6nRuyKoCPzL434Jfi3BetbiJOrzCH
 github.com/oapi-codegen/runtime v1.6.0/go.mod h1:GwV7hC2hviaMzj+ITfHVRESK5J2W/GefVwIND/bMGvU=
 github.com/oasdiff/yaml v0.0.9 h1:zQOvd2UKoozsSsAknnWoDJlSK4lC0mpmjfDsfqNwX48=
 github.com/oasdiff/yaml v0.0.9/go.mod h1:8lvhgJG4xiKPj3HN5lDow4jZHPlx1i7dIwzkdAo6oAM=
-github.com/oasdiff/yaml3 v0.0.9 h1:rWPrKccrdUm8J0F3sGuU+fuh9+1K/RdJlWF7O/9yw2g=
-github.com/oasdiff/yaml3 v0.0.9/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o=
+github.com/oasdiff/yaml3 v0.0.12 h1:75urAtPeDg2/iDEWwzNrLOWxI9N/dCh81nTTJtokt2M=
+github.com/oasdiff/yaml3 v0.0.12/go.mod h1:y5+oSEHCPT/DGrS++Wc/479ERge0zTFxaF8PbGKcg2o=
 github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6 h1:zrbMGy9YXpIeTnGj4EljqMiZsIcE09mmF8XsD5AYOJc=
 github.com/olekukonko/cat v0.0.0-20250911104152-50322a0618f6/go.mod h1:rEKTHC9roVVicUIfZK7DYrdIoM0EOr8mK1Hj5s3JjH0=
 github.com/olekukonko/errors v1.2.0 h1:10Zcn4GeV59t/EGqJc8fUjtFT/FuUh5bTMzZ1XwmCRo=

apps/cli-go/internal/branches/delete/delete.go

@@ -10,6 +10,7 @@ import (
 	"github.com/supabase/cli/internal/branches/pause"
 	"github.com/supabase/cli/internal/utils"
 	"github.com/supabase/cli/pkg/api"
+	"github.com/supabase/cli/pkg/cast"
 )
 
 func Run(ctx context.Context, branchId string, force *bool) error {
@@ -18,7 +19,7 @@ func Run(ctx context.Context, branchId string, force *bool) error {
 		return err
 	}
 	resp, err := utils.GetSupabase().V1DeleteABranchWithResponse(ctx, projectRef, &api.V1DeleteABranchParams{
-		Force: force,
+		Force: cast.BoolToStringPtr(force),
 	})
 	if err != nil {
 		return errors.Errorf("failed to delete preview branch: %w", err)

apps/cli-go/internal/gen/bearerjwt/bearerjwt_test.go

@@ -7,6 +7,7 @@ import (
 	"crypto/elliptic"
 	"crypto/rsa"
 	_ "embed"
+	"encoding/base64"
 	"encoding/json"
 	"io"
 	"testing"
@@ -26,11 +27,17 @@ func TestGenerateToken(t *testing.T) {
 	privateKeyECDSA, err := signingkeys.GeneratePrivateKey(config.AlgES256)
 	require.NoError(t, err)
 	// Setup public key for validation
-	publicKeyECDSA := ecdsa.PublicKey{Curve: elliptic.P256()}
-	publicKeyECDSA.X, err = config.NewBigIntFromBase64(privateKeyECDSA.X)
+	xBytes, err := base64.RawURLEncoding.DecodeString(privateKeyECDSA.X)
 	require.NoError(t, err)
-	publicKeyECDSA.Y, err = config.NewBigIntFromBase64(privateKeyECDSA.Y)
+	yBytes, err := base64.RawURLEncoding.DecodeString(privateKeyECDSA.Y)
 	require.NoError(t, err)
+	uncompressedPoint := make([]byte, 0, 1+len(xBytes)+len(yBytes))
+	uncompressedPoint = append(uncompressedPoint, 0x04)
+	uncompressedPoint = append(uncompressedPoint, xBytes...)
+	uncompressedPoint = append(uncompressedPoint, yBytes...)
+	publicKeyECDSAPtr, err := ecdsa.ParseUncompressedPublicKey(elliptic.P256(), uncompressedPoint)
+	require.NoError(t, err)
+	publicKeyECDSA := *publicKeyECDSAPtr
 
 	// Setup private key - RSA
 	privateKeyRSA, err := signingkeys.GeneratePrivateKey(config.AlgRS256)

apps/cli-go/internal/gen/signingkeys/signingkeys.go

@@ -78,6 +78,17 @@ func generateECDSAKeyPair(keyID uuid.UUID) (*config.JWK, error) {
 
 	publicKey := &privateKey.PublicKey
 
+	// SEC1 uncompressed point: 0x04 || X || Y, each coordinate fixed-length for the curve.
+	pubBytes, err := publicKey.Bytes()
+	if err != nil {
+		return nil, errors.Errorf("failed to encode ECDSA public key: %w", err)
+	}
+	privBytes, err := privateKey.Bytes()
+	if err != nil {
+		return nil, errors.Errorf("failed to encode ECDSA private key: %w", err)
+	}
+	coordLen := (len(pubBytes) - 1) / 2
+
 	// Convert to JWK format
 	privateJWK := config.JWK{
 		KeyType:         "EC",
@@ -87,9 +98,9 @@ func generateECDSAKeyPair(keyID uuid.UUID) (*config.JWK, error) {
 		Algorithm:       "ES256",
 		Extractable:     cast.Ptr(true),
 		Curve:           "P-256",
-		X:               base64.RawURLEncoding.EncodeToString(publicKey.X.Bytes()),
-		Y:               base64.RawURLEncoding.EncodeToString(publicKey.Y.Bytes()),
-		PrivateExponent: base64.RawURLEncoding.EncodeToString(privateKey.D.Bytes()),
+		X:               base64.RawURLEncoding.EncodeToString(pubBytes[1 : 1+coordLen]),
+		Y:               base64.RawURLEncoding.EncodeToString(pubBytes[1+coordLen:]),
+		PrivateExponent: base64.RawURLEncoding.EncodeToString(privBytes),
 	}
 
 	return &privateJWK, nil

apps/cli-go/internal/utils/tenant/client.go

@@ -69,7 +69,7 @@ func isServiceRole(key api.ApiKeyResponse) bool {
 
 func GetApiKeys(ctx context.Context, projectRef string) (ApiKey, error) {
 	resp, err := utils.GetSupabase().V1GetProjectApiKeysWithResponse(ctx, projectRef, &api.V1GetProjectApiKeysParams{
-		Reveal: cast.Ptr(true),
+		Reveal: cast.Ptr("true"),
 	})
 	if err != nil {
 		return ApiKey{}, errors.Errorf("failed to get api keys: %w", err)