From 45a513f8c64c0bc8e0e3dfe572b5c95be85f6359 Mon Sep 17 00:00:00 2001
From: Julien Goux <hi@jgoux.dev>
Date: Thu, 24 Sep 2026 06:04:55 +0200
Subject: [PATCH] fix: allow registry fallback in supported CLI versions (#453)

The action currently pins every recent CLI to GHCR, which disables the
CLI's registry fallback and leaves image pulls exposed to GHCR
throttling.

Use the installed CLI version to keep the GHCR default for versions
before v2.108.0 and allow fallback for newer versions. Preserve a
caller's explicit registry choice.
---
 src/main.test.ts | 53 ++++++++++++++++++++++++++++++++++++++++++++++--
 src/main.ts      | 15 +++++++-------
 2 files changed, 59 insertions(+), 9 deletions(-)

diff --git a/src/main.test.ts b/src/main.test.ts
index c9f4f1c..bd55def 100644
--- a/src/main.test.ts
+++ b/src/main.test.ts
@@ -10,6 +10,7 @@ const originalPath = process.env.PATH;
 const originalNpmUserconfig = process.env.NPM_CONFIG_USERCONFIG;
 const originalRunnerTemp = process.env.RUNNER_TEMP;
 const originalWorkspace = process.env.GITHUB_WORKSPACE;
+const originalImageRegistry = process.env.SUPABASE_INTERNAL_IMAGE_REGISTRY;
 const tempDirs = new Set<string>();
 let mainModule: typeof import("./main.ts") | null = null;
 
@@ -21,8 +22,21 @@ afterEach(() => {
   } else {
     process.env.NPM_CONFIG_USERCONFIG = originalNpmUserconfig;
   }
-  process.env.RUNNER_TEMP = originalRunnerTemp;
-  process.env.GITHUB_WORKSPACE = originalWorkspace;
+  if (originalRunnerTemp === undefined) {
+    delete process.env.RUNNER_TEMP;
+  } else {
+    process.env.RUNNER_TEMP = originalRunnerTemp;
+  }
+  if (originalWorkspace === undefined) {
+    delete process.env.GITHUB_WORKSPACE;
+  } else {
+    process.env.GITHUB_WORKSPACE = originalWorkspace;
+  }
+  if (originalImageRegistry === undefined) {
+    delete process.env.SUPABASE_INTERNAL_IMAGE_REGISTRY;
+  } else {
+    process.env.SUPABASE_INTERNAL_IMAGE_REGISTRY = originalImageRegistry;
+  }
   delete process.env.FAKE_CLI_VERSION;
   delete process.env.FAKE_NPM_BIN;
   delete process.env.FAKE_NPM_INTEGRITY;
@@ -743,6 +757,41 @@ test("explicit version overrides detected root lockfiles", async () => {
   expect(spies.setFailed).not.toHaveBeenCalled();
 });
 
+test("pins legacy installed CLI versions to GHCR", async () => {
+  installFakeNpm("supabase 2.107.0");
+  const spies = createActionSpies("2.107.0");
+  const { run } = await getMainModule();
+
+  await run();
+
+  expect(spies.exportVariable).toHaveBeenCalledWith(CLI_CONFIG_REGISTRY, "ghcr.io");
+  expect(spies.setFailed).not.toHaveBeenCalled();
+});
+
+test("uses the CLI registry fallback for installed versions that support it", async () => {
+  installFakeNpm("supabase 2.108.0");
+  const spies = createActionSpies("latest");
+  const { run } = await getMainModule();
+
+  await run();
+
+  expect(spies.exportVariable).not.toHaveBeenCalled();
+  expect(spies.setFailed).not.toHaveBeenCalled();
+});
+
+test("preserves an explicitly configured image registry for legacy CLI versions", async () => {
+  installFakeNpm("supabase 2.107.0");
+  process.env.SUPABASE_INTERNAL_IMAGE_REGISTRY = "registry.example.test";
+  const spies = createActionSpies("2.107.0");
+  const { run } = await getMainModule();
+
+  await run();
+
+  expect(spies.exportVariable).not.toHaveBeenCalled();
+  expect(process.env.SUPABASE_INTERNAL_IMAGE_REGISTRY).toBe("registry.example.test");
+  expect(spies.setFailed).not.toHaveBeenCalled();
+});
+
 test("fails when the installed CLI does not report a version", async () => {
   installFakeNpm("");
   process.env.GITHUB_WORKSPACE = createWorkspace({
diff --git a/src/main.ts b/src/main.ts
index dac8cc7..da3cc9a 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -7,6 +7,7 @@ import { fileURLToPath } from "node:url";
 
 export const CLI_CONFIG_REGISTRY = "SUPABASE_INTERNAL_IMAGE_REGISTRY";
 const REGISTRY_VERSION = "1.28.0";
+const FALLBACK_VERSION = "2.108.0";
 const DEFAULT_VERSION = "latest";
 const NPM_PACKAGE = "supabase";
 const NPM_EXECUTABLE_ENV = "SUPABASE_SETUP_CLI_NPM";
@@ -379,13 +380,13 @@ export async function determineInstalledVersion(cliPath: string): Promise<string
   return version;
 }
 
-function shouldUseGhcrRegistry(requestedVersion: string, installedVersion: string): boolean {
-  if (requestedVersion.toLowerCase() === DEFAULT_VERSION) {
-    return true;
-  }
-
+function shouldUseGhcrRegistry(installedVersion: string): boolean {
   const concreteVersion = extractConcreteVersion(installedVersion);
-  return concreteVersion !== null && semver.order(concreteVersion, REGISTRY_VERSION) >= 0;
+  return (
+    concreteVersion !== null &&
+    semver.order(concreteVersion, REGISTRY_VERSION) >= 0 &&
+    semver.order(concreteVersion, FALLBACK_VERSION) < 0
+  );
 }
 
 export async function run(): Promise<void> {
@@ -396,7 +397,7 @@ export async function run(): Promise<void> {
     core.setOutput("version", installedVersion);
     core.addPath(cliPath);
 
-    if (shouldUseGhcrRegistry(resolution.version, installedVersion)) {
+    if (shouldUseGhcrRegistry(installedVersion) && !process.env[CLI_CONFIG_REGISTRY]) {
       core.exportVariable(CLI_CONFIG_REGISTRY, "ghcr.io");
     }
   } catch (error) {