chore: production deploy

.github/workflows/cli-go-ci.yml

@@ -35,6 +35,19 @@ jobs:
           go tool gotestsum -- -race -v -count=1 ./... \
           -coverpkg="./cmd/...,./internal/...,${pkgs}" -coverprofile=coverage.out
 
+      # internal/start (docker-compose/v2, buildx, moby/buildkit, k8s client-go,
+      # aws-sdk-go-v2, notary, secret-detector) was deleted outright as
+      # unreachable (CLI-1966) -- this guards against silently reintroducing
+      # that dependency tree via some other package, since nothing else checks
+      # the shipped binary's size on every change.
+      - name: Verify the heavy orchestration dependency tree stays out of the module
+        run: |
+          set -euo pipefail
+          go list -deps . > /tmp/deps.txt
+          ! grep -Eq \
+            'docker/compose|docker/buildx|moby/buildkit|k8s\.io/client-go|aws-sdk-go-v2' \
+            /tmp/deps.txt
+
       - name: Check existing coverage cache
         id: coverage-cache
         uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
@@ -65,7 +78,7 @@ jobs:
       - name: Move coverage report
         run: cp apps/cli-go/coverage.out coverage.out
         working-directory: .
-      - uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # v2.3.7
+      - uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8
         with:
           file: coverage.out
           format: golang
@@ -93,30 +106,6 @@ jobs:
           only-new-issues: true
           working-directory: apps/cli-go
 
-  start:
-    name: Start
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
-        with:
-          go-version-file: apps/cli-go/go.mod
-          cache: true
-      - run: go build main.go
-      - run: ./main init
-      - run: sed -i '/\[db.pooler\]/{n;s/.*/enabled = true/}' supabase/config.toml
-      - run: ./main start --workdir tests
-        env:
-          SUPABASE_INTERNAL_IMAGE_REGISTRY: ghcr.io
-      - name: Install websocat
-        run: |
-          sudo wget -qO /usr/local/bin/websocat https://github.com/vi/websocat/releases/latest/download/websocat.x86_64-unknown-linux-musl
-          sudo chmod a+x /usr/local/bin/websocat
-          websocat --version
-      - run: ./e2e-test.sh ./main
-
   link:
     name: Link
     if: ${{ github.event_name == 'merge_group' || (github.event_name ==

.github/workflows/cli-go-codeql.yml

@@ -67,7 +67,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -95,7 +95,7 @@ jobs:
           exit 1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           category: "/language:${{matrix.language}}"
 defaults:

.github/workflows/cli-go-mirror-image.yml

@@ -38,10 +38,10 @@ jobs:
         with:
           role-to-assume: ${{ secrets.PROD_AWS_ROLE }}
           aws-region: us-east-1
-      - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: public.ecr.aws
-      - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/cli-go-mirror.yml

@@ -10,8 +10,9 @@ on:
   # This workflow is the manual/bulk entry point for re-mirroring everything.
   # Template image bumps are mirrored automatically by mirror-template-images.yml
   # on push to develop, which backfills any unmirrored tag when the templates
-  # Dockerfile changes — so develop and PRs rebased on it stop inheriting the
-  # `manifest unknown` failure in the ghcr.io-pinned `Start` check.
+  # Dockerfile changes — so anyone pinning SUPABASE_INTERNAL_IMAGE_REGISTRY=ghcr.io
+  # doesn't inherit a `manifest unknown` failure. (No CI job pins that registry
+  # anymore -- see mirror-template-images.yml's own comment for why, CLI-1966.)
   workflow_dispatch:
 permissions:
   contents: read

.github/workflows/cli-go-pg-prove.yml

@@ -45,7 +45,7 @@ jobs:
       - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
         with:
           endpoint: builders
-      - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -67,7 +67,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-      - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}

.github/workflows/cli-go-publish-migra.yml

@@ -45,7 +45,7 @@ jobs:
       - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
         with:
           endpoint: builders
-      - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
@@ -67,7 +67,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-      - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}

.github/workflows/mirror-template-images.yml

@@ -8,11 +8,14 @@ name: Mirror template images
 #
 # It runs on `push` to develop (not on the PR) on purpose: mirroring needs the
 # AWS role + packages:write, which a dependabot-triggered `pull_request` run
-# cannot be granted, and we deliberately avoid `pull_request_target`. The CI
-# `Start` job pins SUPABASE_INTERNAL_IMAGE_REGISTRY=ghcr.io, so it only goes
-# green once a bumped tag is mirrored here; this backfill runs as soon as the
-# bump lands on develop, repopulating ghcr.io/ECR so develop and any PR rebased
-# on it pass `Start` instead of inheriting a `manifest unknown` failure.
+# cannot be granted, and we deliberately avoid `pull_request_target`. This
+# backfill runs as soon as the bump lands on develop, repopulating ghcr.io/ECR
+# so anyone pinning SUPABASE_INTERNAL_IMAGE_REGISTRY=ghcr.io doesn't inherit a
+# `manifest unknown` failure. (No CI job pins that registry anymore -- the
+# `cli-go-ci.yml` `Start` job that used to made it CI-observable was removed in
+# CLI-1966 along with `internal/start`; this mirror now only serves users who
+# opt into the mirror directly, and a mirroring failure no longer turns any
+# check red.)
 
 on:
   push:
@@ -50,7 +53,7 @@ jobs:
           dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
 
       - name: Log in to ghcr.io
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}

.github/workflows/release-shared.yml

@@ -426,7 +426,7 @@ jobs:
 
       - name: Sync stable release to Linear
         if: ${{ inputs.channel == 'stable' && env.LINEAR_CLI_STABLE_RELEASE_ACCESS_KEY != '' }}
-        uses: linear/linear-release-action@3858a5d7892435dc63302ac76b0cdb587435caa9 # v0
+        uses: linear/linear-release-action@af56a9a388625921f3757a2f988e4d7aca958377 # v0
         with:
           access_key: ${{ env.LINEAR_CLI_STABLE_RELEASE_ACCESS_KEY }}
           version: v${{ inputs.version }}
@@ -437,7 +437,7 @@ jobs:
 
       - name: Sync beta release to Linear
         if: ${{ inputs.channel == 'beta' && env.LINEAR_CLI_BETA_RELEASE_ACCESS_KEY != '' }}
-        uses: linear/linear-release-action@3858a5d7892435dc63302ac76b0cdb587435caa9 # v0
+        uses: linear/linear-release-action@af56a9a388625921f3757a2f988e4d7aca958377 # v0
         with:
           access_key: ${{ env.LINEAR_CLI_BETA_RELEASE_ACCESS_KEY }}
           version: v${{ inputs.version }}

.gitignore

@@ -1,6 +1,7 @@
 node_modules
 dist
 coverage/
+.DS_Store
 .env
 .env.*
 !.env.example
@@ -22,4 +23,4 @@ packages/cli-*/bin/
 
 # Nx
 .nx/cache
-.nx/workspace-data
+.nx/workspace-data

apps/cli-e2e/fixtures/scenarios/branches-list-returns-json-output-with-output-json/interactions.json

@@ -23,7 +23,7 @@
       },
       "body": [
         {
-          "id": "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee",
+          "id": "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee",
           "name": "test-branch",
           "project_ref": "branchrefaaaaaaaaa",
           "parent_project_ref": "__PROJECT_REF__",

apps/cli-e2e/src/tests/live/db-reset-start.live.e2e.test.ts

@@ -13,9 +13,14 @@ import { testLive } from "./live-context.ts";
 // destructive remote reset below is safe against the throwaway per-run project.
 
 // --- Local leg: db start + db reset --local against the real Docker socket -----
-// Exercises the hidden `db __db-bootstrap` Go seam end-to-end — the boundary the
-// in-process integration suites mock. The start → already-running → reset cycle
-// runs in one test so it shares a single booted stack, and `finally` stops it
+// Exercises `db start`'s native container-bootstrap sequence (network/volume/container
+// bring-up, health wait, the fresh-volume SetupLocalDatabase-equivalent pipeline, and
+// `_current_branch`) and `db reset --local`'s container-recreate flow end-to-end — the
+// real-Docker boundary the in-process integration suites mock. `db reset --local` still
+// delegates its container-recreate flow to the bundled Go binary's hidden
+// `db __db-bootstrap --mode recreate` seam (CLI-1955, unclaimed as of CLI-1954); `db start`
+// no longer does (see `commands/db/start/start.handler.ts`). The start → already-running →
+// reset cycle runs in one test so it shares a single booted stack, and `finally` stops it
 // (legacy proxies `stop` to Go) so the run never leaves containers behind.
 describe.skipIf(TARGET === "ts-next")("db start / db reset --local (live, local Docker)", () => {
   testLive(
@@ -25,7 +30,7 @@ describe.skipIf(TARGET === "ts-next")("db start / db reset --local (live, local
       try {
         const start = await run(["db", "start"]);
         expect(start.exitCode, start.stderr).toBe(0);
-        // Go tees bootstrap progress to stderr (mode-independent).
+        // Bootstrap progress goes to stderr on every target (Go, and native TS since CLI-1954).
         expect(`${start.stdout}${start.stderr}`).toMatch(/Starting database|Initialising schema/i);
 
         // Second start is a no-op: the db is already running, exit 0.

apps/cli-e2e/src/tests/stack.e2e.test.ts

@@ -142,7 +142,13 @@ describe("start", () => {
   test.todo("start → status → stop lifecycle");
   test.todo("starts with --exclude studio and stops cleanly");
 
-  test.todo("parity: start");
+  // Unlike `status`/`stop` above, there is no `testParityStack(["start"])` here,
+  // and there never will be: Go's `internal/start` was deleted outright as
+  // unreachable (CLI-1966), so `supabase-go start` is now a permanent stub that
+  // always fails with a fixed error -- there is no real Go implementation left to
+  // diff TS's behavior against. Go-parity coverage for `start` instead lives in
+  // `apps/cli/src/legacy/commands/start/start.live.test.ts` and its siblings,
+  // asserted against the pre-deletion Go behavior documented in `SIDE_EFFECTS.md`.
 });
 
 // ---------------------------------------------------------------------------

apps/cli-go/.gitignore

@@ -9,6 +9,7 @@
 *.so
 *.dylib
 /cli
+/main
 /supabase-go
 
 # Test binary, built with `go test -c`

apps/cli-go/cmd/db.go

@@ -1,7 +1,6 @@
 package cmd
 
 import (
-	"context"
 	"errors"
 	"fmt"
 	"os"
@@ -271,24 +270,29 @@ var (
 		},
 	}
 
-	bootstrapMode       string
-	bootstrapSqlPaths   []string
-	bootstrapFromBackup string
-	bootstrapVersion    string
-	bootstrapNoSeed     bool
-
-	// dbBootstrapCmd is a hidden seam used by the native-TypeScript `db start` and
-	// `db reset --local` commands to drive the container-bootstrap primitives that
-	// are not yet ported to TypeScript: creating/recreating the local Postgres
-	// container, applying the initial schema, and the storage health gate. The TS
-	// caller orchestrates everything else (the "already running?" check and its
-	// message, version/last resolution, bucket seeding, the git-branch "Finished…"
-	// line, telemetry, and --output-format shaping); the seam stays in Go only for
-	// the Docker lifecycle. It mirrors the existing db __shadow seam: it carries no
+	bootstrapMode     string
+	bootstrapSqlPaths []string
+	bootstrapVersion  string
+	bootstrapNoSeed   bool
+
+	// dbBootstrapCmd is a hidden seam used by the native-TypeScript `db reset --local`
+	// command to drive the container-bootstrap primitives that are not yet ported to
+	// TypeScript: recreating the local Postgres container, applying the initial
+	// schema, and the storage health gate. The TS caller orchestrates everything else
+	// (version/last resolution, bucket seeding, the git-branch "Finished…" line,
+	// telemetry, and --output-format shaping); the seam stays in Go only for the
+	// Docker lifecycle. It mirrors the existing db __shadow seam: it carries no
 	// db-url/local/linked target flags, so it loads supabase/config.toml explicitly
 	// (the root PersistentPreRunE only loads it when a target flag is set). Progress
 	// goes to stderr; the only stdout output is a single machine-parseable marker
-	// for --mode await-storage ("ready" or "absent").
+	// for --mode await-storage ("ready" or "absent"). `db start`'s own container
+	// bootstrap (--mode start) was removed from this seam by CLI-1954 — it is now a
+	// fully native TypeScript implementation
+	// (apps/cli/src/legacy/commands/db/start/start.handler.ts), reusing
+	// legacy/shared/db-bootstrap/'s already-ported container-bootstrap primitives
+	// instead of shelling out to this binary. `start.StartDatabase` itself (called
+	// below by the real, customer-facing `db start` Go command) is untouched — it
+	// remains the parity oracle this TS port was checked against.
 	dbBootstrapCmd = &cobra.Command{
 		Use:    "__db-bootstrap",
 		Hidden: true,
@@ -299,16 +303,6 @@ var (
 				return err
 			}
 			switch bootstrapMode {
-			case "start":
-				// Mirror start.Run minus the "already running?" check, which the TS
-				// caller performs (and prints "Postgres database is already running.").
-				if err := start.StartDatabase(cmd.Context(), bootstrapFromBackup, fsys, os.Stderr); err != nil {
-					if rmErr := utils.DockerRemoveAll(context.Background(), os.Stderr, utils.Config.ProjectId); rmErr != nil {
-						fmt.Fprintln(os.Stderr, rmErr)
-					}
-					return err
-				}
-				return nil
 			case "recreate":
 				// The PG14/PG15 container-recreate half of local db reset. The TS
 				// caller has already printed "Resetting local database…" and validated
@@ -688,8 +682,7 @@ func init() {
 	dbCmd.AddCommand(dbShadowCmd)
 	// Build hidden container-bootstrap seam command (native db start / db reset)
 	bootstrapFlags := dbBootstrapCmd.Flags()
-	bootstrapFlags.StringVar(&bootstrapMode, "mode", "start", "Bootstrap mode: start, recreate, or await-storage.")
-	bootstrapFlags.StringVar(&bootstrapFromBackup, "from-backup", "", "Path to a logical backup file (start mode).")
+	bootstrapFlags.StringVar(&bootstrapMode, "mode", "recreate", "Bootstrap mode: recreate or await-storage.")
 	bootstrapFlags.StringVar(&bootstrapVersion, "version", "", "Reset up to the specified version (recreate mode).")
 	bootstrapFlags.BoolVar(&bootstrapNoSeed, "no-seed", false, "Skip the seed script after recreate (recreate mode).")
 	bootstrapFlags.StringArrayVar(&bootstrapSqlPaths, "sql-paths", nil, "Override [db.seed].sql_paths for the recreate (recreate mode).")