fix: allow registry fallback in supported CLI versions

The action currently pins every recent CLI to GHCR, which disables the
CLI's registry fallback and leaves image pulls exposed to GHCR
throttling.

Use the installed CLI version to keep the GHCR default for versions
before v2.108.0 and allow fallback for newer versions. Preserve a
caller's explicit registry choice and update the bundled v1 action.

__tests__/main.test.ts

@@ -1,18 +1,21 @@
 import { getCliPath, getDownloadArchive, getDownloadUrl } from '../src/utils'
-import { CLI_CONFIG_REGISTRY } from '../src/main'
+import { shouldPinGhcrRegistry } from '../src/main'
-import * as os from 'os'
-import * as process from 'process'
-import * as cp from 'child_process'
-import * as path from 'path'
-import * as fs from 'fs'
-import * as yaml from 'js-yaml'
-import * as url from 'url'
 import { afterEach, expect, jest, test } from '@jest/globals'
 
 afterEach(() => {
   jest.restoreAllMocks()
 })
 
+test('pins GHCR for legacy CLI versions until registry fallback support', () => {
+  expect(shouldPinGhcrRegistry('1.28.0', undefined)).toBe(true)
+  expect(shouldPinGhcrRegistry('2.107.0', undefined)).toBe(true)
+  expect(shouldPinGhcrRegistry('2.108.0', undefined)).toBe(false)
+})
+
+test('preserves a configured image registry', () => {
+  expect(shouldPinGhcrRegistry('2.107.0', 'registry.example.test')).toBe(false)
+})
+
 test('gets download url to binary', async () => {
   const url = await getDownloadUrl('1.28.0')
   expect(
@@ -138,26 +141,3 @@ test('keeps unversioned archive url to binary before Supabase CLI v2.99.0', asyn
   expect(url).not.toContain('supabase_2.98.2_')
   expect(url).toMatch(/\.tar\.gz$/)
 })
-
-// shows how the runner will run a javascript action with env / stdout protocol
-test('runs main action', () => {
-  const { env, execPath } = process
-  const repo = path.dirname(path.dirname(url.fileURLToPath(import.meta.url)))
-  const config = path.join(repo, 'action.yml')
-  const action = yaml.load(fs.readFileSync(config, 'utf8')) as {
-    inputs: { version: { default: string } }
-  }
-  const ip = path.join(repo, 'dist', 'index.js')
-  const stdout = cp
-    .execFileSync(execPath, [ip], {
-      env: {
-        ...env,
-        RUNNER_TEMP: os.tmpdir(),
-        INPUT_VERSION: action.inputs.version.default
-      }
-    })
-    .toString()
-  expect
-    .stringContaining(`::set-env name=${CLI_CONFIG_REGISTRY}::`)
-    .asymmetricMatch(stdout)
-})

dist/index.js

@@ -60567,6 +60567,11 @@ const determineInstalledVersion = async () => {
 };
 
 const CLI_CONFIG_REGISTRY = 'SUPABASE_INTERNAL_IMAGE_REGISTRY';
+const REGISTRY_VERSION = '1.28.0';
+const FALLBACK_VERSION = '2.108.0';
+const shouldPinGhcrRegistry = (installedVersion, configuredRegistry) => !configuredRegistry &&
+    semverExports.gte(installedVersion, REGISTRY_VERSION) &&
+    semverExports.lt(installedVersion, FALLBACK_VERSION);
 /**
  * The main function for the action.
  *
@@ -60591,8 +60596,8 @@ async function run() {
         // Expose installed tool version
         const determinedVersion = await determineInstalledVersion();
         setOutput('version', determinedVersion);
-        // Use GHCR mirror by default
+        // Use GHCR for CLI versions without registry fallback support.
-        if (version.toLowerCase() === 'latest' || semverExports.gte(version, '1.28.0')) {
+        if (shouldPinGhcrRegistry(determinedVersion.replace(/^supabase\s+/i, '').replace(/^v/i, ''), process.env[CLI_CONFIG_REGISTRY])) {
             exportVariable(CLI_CONFIG_REGISTRY, 'ghcr.io');
         }
     }

src/main.ts

@@ -1,6 +1,6 @@
 import * as core from '@actions/core'
 import * as tc from '@actions/tool-cache'
-import { gte } from 'semver'
+import { gte, lt } from 'semver'
 import {
   getDownloadArchive,
   determineInstalledVersion,
@@ -9,6 +9,16 @@ import {
 } from './utils.js'
 
 export const CLI_CONFIG_REGISTRY = 'SUPABASE_INTERNAL_IMAGE_REGISTRY'
+const REGISTRY_VERSION = '1.28.0'
+const FALLBACK_VERSION = '2.108.0'
+
+export const shouldPinGhcrRegistry = (
+  installedVersion: string,
+  configuredRegistry: string | undefined
+): boolean =>
+  !configuredRegistry &&
+  gte(installedVersion, REGISTRY_VERSION) &&
+  lt(installedVersion, FALLBACK_VERSION)
 
 /**
  * The main function for the action.
@@ -47,8 +57,13 @@ export async function run(): Promise<void> {
     const determinedVersion = await determineInstalledVersion()
     core.setOutput('version', determinedVersion)
 
-    // Use GHCR mirror by default
+    // Use GHCR for CLI versions without registry fallback support.
-    if (version.toLowerCase() === 'latest' || gte(version, '1.28.0')) {
+    if (
+      shouldPinGhcrRegistry(
+        determinedVersion.replace(/^supabase\s+/i, '').replace(/^v/i, ''),
+        process.env[CLI_CONFIG_REGISTRY]
+      )
+    ) {
       core.exportVariable(CLI_CONFIG_REGISTRY, 'ghcr.io')
     }
   } catch (error) {