fix: setup-cli on Linux musl containers (#431)

## Summary

Fixes setup-cli in Alpine/Linux musl containers after the Supabase CLI
v2.99+ release layout introduced a Bun/TypeScript `supabase` shim
alongside `supabase-go`.

This keeps the v2 action on Bun, but makes the musl paths explicit:

- Detect Linux musl before running `oven-sh/setup-bun` and pass the
matching `bun-linux-*-musl.zip` via `bun-download-url`.
- Use POSIX `sh` for composite shell steps so the action can run in
minimal Alpine containers without `bash`.
- Detect Linux musl in the CLI installer and download the existing
`.apk` release asset for CLI v2.99+.
- Add the extracted APK `usr/bin` directory to PATH.
- Keep existing tar/zip behavior for glibc Linux, macOS, and Windows.

## Root Cause

`oven-sh/setup-bun` does not currently include libc detection in its
automatic release asset selection, so Alpine containers received a glibc
Bun binary. Separately, setup-cli downloaded the generic Linux `.tar.gz`
Supabase CLI asset, whose `supabase` shim is glibc-linked in v2.99+; the
`.apk` asset contains the musl-linked shim.

## Testing

- `bun run ci`
- Manual GitHub workflow in
https://github.com/jgoux/setup-cli-testing/actions/runs/2616196598653

src/main.ts

@@ -12,7 +12,7 @@ const DEFAULT_VERSION = "latest";
 const GITHUB_RELEASES_API = "https://api.github.com/repos/supabase/cli/releases/latest";
 const GITHUB_TOKEN_ENV = "SUPABASE_CLI_GITHUB_TOKEN";
 
-type ArchiveFormat = "tar" | "zip";
+type ArchiveFormat = "apk" | "tar" | "zip";
 
 type DownloadArchive = {
   url: string;
@@ -199,7 +199,19 @@ async function resolveLatestVersion(): Promise<string> {
   return normalizeVersion(release.tag_name);
 }
 
-function getArchiveFormat(version: string, platform: NodeJS.Platform): ArchiveFormat {
+function getArchiveFormat(
+  version: string,
+  platform: NodeJS.Platform,
+  isMuslLinux: boolean,
+): ArchiveFormat {
+  if (
+    platform === "linux" &&
+    isMuslLinux &&
+    semver.order(version, VERSIONED_ARCHIVE_VERSION) >= 0
+  ) {
+    return "apk";
+  }
+
   if (platform === "win32" && semver.order(version, VERSIONED_ARCHIVE_VERSION) >= 0) {
     return "zip";
   }
@@ -211,6 +223,7 @@ function getArchiveFilename(
   version: string,
   platform: NodeJS.Platform,
   arch: NodeJS.Architecture,
+  archiveFormat: ArchiveFormat,
 ): string {
   const archivePlatform = getArchivePlatform(platform);
   const archiveArch = getArchiveArch(arch);
@@ -219,6 +232,10 @@ function getArchiveFilename(
     return `supabase_${version}_${archivePlatform}_${archiveArch}.tar.gz`;
   }
 
+  if (platform === "linux" && archiveFormat === "apk") {
+    return `supabase_${version}_${archivePlatform}_${archiveArch}.apk`;
+  }
+
   if (semver.order(version, VERSIONED_ARCHIVE_VERSION) >= 0) {
     const extension = platform === "win32" ? "zip" : "tar.gz";
     return `supabase_${version}_${archivePlatform}_${archiveArch}.${extension}`;
@@ -231,17 +248,45 @@ export async function getDownloadArchive(
   version: string,
   platform = process.platform,
   arch = process.arch,
+  isMuslLinux?: boolean,
 ): Promise<DownloadArchive> {
   const resolvedVersion =
     version.toLowerCase() === "latest" ? await resolveLatestVersion() : normalizeVersion(version);
-  const filename = getArchiveFilename(resolvedVersion, platform, arch);
+  const format = getArchiveFormat(
+    resolvedVersion,
+    platform,
+    isMuslLinux ?? (await detectMuslLinux(platform)),
+  );
+  const filename = getArchiveFilename(resolvedVersion, platform, arch, format);
 
   return {
     url: `https://github.com/supabase/cli/releases/download/v${resolvedVersion}/${filename}`,
-    format: getArchiveFormat(resolvedVersion, platform),
+    format,
   };
 }
 
+async function detectMuslLinux(platform = process.platform): Promise<boolean> {
+  if (platform !== "linux") {
+    return false;
+  }
+
+  if (existsSync("/etc/alpine-release")) {
+    return true;
+  }
+
+  try {
+    const output = await $`ldd --version`.quiet().text();
+    return output.toLowerCase().includes("musl");
+  } catch (error) {
+    const output = error instanceof Error ? error.message : String(error);
+    return output.toLowerCase().includes("musl");
+  }
+}
+
+export function getCliPath(extractedPath: string, archiveFormat: ArchiveFormat): string {
+  return archiveFormat === "apk" ? path.join(extractedPath, "usr", "bin") : extractedPath;
+}
+
 function getCliExecutablePath(cliPath: string): string {
   if (process.platform !== "win32") {
     return path.join(cliPath, "supabase");
@@ -274,10 +319,11 @@ export async function run(): Promise<void> {
     const version = resolveVersion(core.getInput("version"));
     const archive = await getDownloadArchive(version);
     const archivePath = await tc.downloadTool(archive.url);
-    const cliPath =
+    const extractedPath =
       archive.format === "zip"
         ? await tc.extractZip(archivePath)
         : await tc.extractTar(archivePath);
+    const cliPath = getCliPath(extractedPath, archive.format);
     const installedVersion = await determineInstalledVersion(cliPath);
     core.setOutput("version", installedVersion);
     core.addPath(cliPath);