fix(cli): follow symlinks in function source directories during deploy - #6087
fix(cli): follow symlinks in function source directories during deploy#6087avallete wants to merge 2 commits into
Conversation
…the git root (INC-699)
An API deploy whose supabase/functions dir (or a single function dir) is a
symlink pointing outside the nearest git root uploaded no file parts at all:
the realpath-based containment boundary silently skipped the entrypoint with
only a stderr WARN ("Skipping import path outside source root"), the request
went out metadata-only, and the Management API rejected it with 400
"Entrypoint path does not exist - .../source/supabase/functions/<slug>/index.ts"
(reported in the INC-699 incident channel on 2026-08-05, SupabaseCLI/2.111.0).
The Go CLI follows symlinks unconditionally (pkg/function/deno.go "Assume no
file is symlinked"), so the skip was a TS-only regression introduced with the
#5755 containment boundary. Widen the boundary with the real (symlink-resolved)
directories of supabase/functions and the function entrypoint, mirroring the
existing resolveImportMapAllowedRoots precedent for out-of-root import maps.
Uploaded names and recorded metadata stay anchored at the workdir per CLI-1985;
the same widening applies to the Docker bundler's module roots so symlinked
sources get their read-only binds.
Non-symlinked layouts are byte-for-byte unchanged, and the Go-parity `..`-name
rejection (hasParentPathSegment) still guards genuinely escaping names.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0142Gar1VCPkaW3jWBNxg9SP
Supabase CLI previewnpx --yes https://pkg.pr.new/supabase/cli/supabase@ac3c117407f387772cf2d4d7a450bac96ffb245fPreview package for commit |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ac3c117407
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| [hostFunctionsDir, dirname(resolve(config.entrypoint))], | ||
| ); |
There was a problem hiding this comment.
When a single function directory is symlinked outside the git root and the function declares static_files, this widened root list is only used for moduleRoots. The later static-file loop still goes through appendProjectBind, which checks only [realSourceRoot], so real paths under the symlink target are silently omitted from the Docker -v binds while the bundler still receives --static for the symlinked path. That leaves --use-docker deploys and serve/start unable to read those assets even though Go follows the symlink; use the same widened asset roots for static-file binds too.
AGENTS.md reference: apps/cli/AGENTS.md:L247-L257
Useful? React with 👍 / 👎.
2 participants
Summary
Fixes a regression where symlinked function source directories (or the
supabase/functionsdirectory itself) whose targets lie outside the git root were silently skipped during deploy, causing the API to reject the request with "Entrypoint path does not exist".The Go CLI follows symlinks unconditionally when walking function sources. The TypeScript implementation was enforcing a git-root containment boundary that excluded symlink targets, even though the uploaded file names and metadata paths remained anchored inside the workdir.
The fix widens the containment boundary to include the real (symlink-resolved) paths of:
supabase/functionsdirectoryThis mirrors the existing
resolveImportMapAllowedRootspattern and restores parity with Go's behavior.Changes
apps/cli/src/shared/functions/deploy.ts: AddedwithRealSourceDirs()helper to expand containment roots with the real paths of function source directories. UpdatedwriteSourceDeployForm()andbuildDockerBinds()to use this helper when validating asset paths.apps/cli/src/legacy/commands/functions/deploy/deploy.integration.test.ts: Added integration test covering symlinked function directories outside the git root, verifying that sources upload correctly with workdir-anchored names.apps/cli/src/legacy/commands/functions/deploy/SIDE_EFFECTS.md: Updated documentation to explain the expanded containment boundary.Linked issue
open-for-contributionlabel (or I'm a Supabase maintainer).Checklist
fix(cli): …).pnpm check:allandpnpm testpass for the workspace(s) I touched.https://claude.ai/code/session_0142Gar1VCPkaW3jWBNxg9SP