## Summary - Run npm commands from the caller workspace so npm remains the source of truth for `.npmrc` parsing, auth, delegated config files, env expansion, quoting, and precedence. - Keep the CLI install isolated with `--prefix`, while explicitly overriding action-owned npm policy such as `offline=false`, `bin-links=true`, and no package lock. - Treat existing `node` and `npm` commands on musl as sufficient only when they actually run, probing Alpine `/usr/bin` binaries with `/usr/bin` first on PATH. - Prefer Alpine `/usr/bin` runtime binaries when an earlier PATH entry shadows them, and keep apk installation for missing runtime libraries or missing commands. ## Validation - `bun run ci` - Real npm sanity check for workspace `.npmrc` with quoted/env delegated config, `globalconfig`, relative `cafile`, mTLS path keys, `offline=true`, `bin-links=false`, and package-lock policy - Fixture workflow: https://github.com/jgoux/setup-cli-testing/actions/runs/28663875606 Addresses https://github.com/supabase/setup-cli/pull/442#discussion_r3519786253 Addresses https://github.com/supabase/setup-cli/pull/442#discussion_r3519786255
⚙️ Supabase CLI Action
About
This composite action sets up the Supabase CLI,
supabase, on GitHub's hosted Actions
runners. Other CI runners like
Bitbucket
and
GitLab
are supported via their respective pipelines.
This action can be run on ubuntu-latest, windows-latest, and macos-latest
GitHub Actions runners, and will install and expose a specified version of the
supabase CLI on the runner environment.
Usage
Setup the supabase CLI:
steps:
- uses: supabase/setup-cli@v3
If version is omitted, the action checks the repository root for bun.lock,
pnpm-lock.yaml, or package-lock.json and installs the declared supabase
package version through npm. If the lockfile includes package integrity
metadata, the action verifies it against the npm registry before installing. If
no supported lockfile is present, it falls back to latest.
The action uses an existing Node.js/npm runtime when one is already available, and requires Node.js 20 or newer. On non-musl runners without Node.js or npm, it provisions them internally. Runners must be able to reach the npm registry to install the CLI package.
When running in Alpine or other Linux musl containers, the action uses Alpine's
nodejs and npm packages instead of actions/setup-node, because the
standard Node.js runner binaries target glibc. Root containers can have missing
runtime packages installed automatically. Non-root containers must include
Node.js 20+ and the runtime packages in the image before the action runs:
FROM alpine:3.20
RUN apk add --no-cache libstdc++ libgcc nodejs npm
USER 1000:1000
A fixed npm-published version, latest, or beta of the supabase CLI can be
installed:
steps:
- uses: supabase/setup-cli@v3
with:
version: 2.84.2
steps:
- uses: supabase/setup-cli@v3
with:
version: beta
Run supabase db start to execute all migrations on a fresh database:
steps:
- uses: supabase/setup-cli@v3
with:
version: latest
- run: supabase init
- run: supabase db start
Since Supabase CLI relies on Docker Engine API, additional setup may be required on Windows and macOS runners.
Inputs
The action supports the following inputs:
| Name | Type | Description | Default | Required |
|---|---|---|---|---|
version |
String | Supabase CLI latest, beta, or fixed version published to npm |
Root lockfile version or latest |
false |
Advanced Usage
Check generated TypeScript types are up-to-date with Postgres schema:
steps:
- uses: supabase/setup-cli@v3
- run: supabase init
- run: supabase db start
- name: Verify generated types match Postgres schema
run: |
supabase gen types typescript --local > schema.gen.ts
if ! git diff --ignore-space-at-eol --exit-code --quiet schema.gen.ts; then
echo "Detected uncommitted changes after build. See status below:"
git diff
exit 1
fi
Release job to push schema changes to a Supabase project:
env:
SUPABASE_ACCESS_TOKEN: ${{ secrets.ACCESS_TOKEN }}
SUPABASE_DB_PASSWORD: ${{ secrets.DB_PASSWORD }}
# Retrieve <project-id> from dashboard url: https://app.supabase.com/project/<project-id>
PROJECT_ID: <project-id>
steps:
- uses: supabase/setup-cli@v3
- run: supabase link --project-ref $PROJECT_ID
- run: supabase db push
Export local Supabase env vars for app tests:
steps:
- uses: supabase/setup-cli@v3
- run: supabase init
- run: supabase start
- name: Export local Supabase env vars
run: |
# Customize the variable names as needed for your app.
supabase status -o env \
--override-name api.url=SUPABASE_URL \
--override-name auth.service_role_key=SUPABASE_SERVICE_ROLE_KEY \
>> .env.test
- run: bun test
Develop
After you've cloned the repository to your local machine or codespace, you'll need to perform a few setup steps before you can work on the action.
Note
You'll need a recent version of Bun for local development. This repository includes a
.bun-versionfile for tools that can auto-switch Bun versions.
-
🛠️ Install the dependencies
bun install -
✅ Run the tests
bun test -
🔍 Run the full local CI suite
bun run ci
Publish
- Create a new GitHub release
- Rebase
v3branch onmain
Your action is now published! 🚀
See the versioning documentation
Validate
Validate changes by exercising the action from a workflow in this repository (see ci.yml and e2e.yml).
steps:
- uses: ./
with:
version: latest
The CI workflow provides fast smoke coverage across GitHub-hosted runners, and
the E2E workflow verifies supabase init and supabase start against supported
Postgres versions. See the actions tab
for recent runs.