Merge remote-tracking branch 'origin/next' into sync/develop-into-next

# Conflicts:
#	apps/cli-go/pkg/config/templates/Dockerfile

Author: github-actions[bot]

.gitattributes

@@ -14,16 +14,12 @@ apps/cli/src/shared/telemetry/__fixtures__/error-tags.txt text eol=lf
 # statistics and collapses them in pull request diffs -- they are build output to
 # be regenerated, not code to review, and together they outweigh the hand-written
 # source. The attribute is GitHub-only: git, CI, and local diffs are unaffected.
-# Collapsed is not hidden. v1-openapi.yaml and the lockfiles do carry changes
-# worth reading -- an upstream API change, a dependency substitution -- and both
-# stay one click away in review.
-# Regeneration is owned by `go generate` in apps/cli-go and by the `generate`
-# turbo task, whose `outputs` in turbo.json are the source of truth for this list.
-# Only the generated files are listed, not their hand-written inputs
-# (pkg/api/*.cfg.yaml, api/overlay.yaml). apps/docs/content/docs/commands/ is
-# generated too but gitignored, so it needs no entry.
-apps/cli-go/api/v1-openapi.yaml linguist-generated=true
-apps/cli-go/pkg/api/*.gen.go linguist-generated=true
+# Collapsed is not hidden. The lockfile does carry changes worth reading --
+# a dependency substitution -- and stays one click away in review.
+# Regeneration is owned by the `generate` turbo task, whose `outputs` in
+# turbo.json are the source of truth for this list. Only the generated files
+# are listed, not their hand-written inputs. apps/docs/content/docs/commands/
+# is generated too but gitignored, so it needs no entry.
 packages/api/src/generated/* linguist-generated=true
 packages/api/scripts/openapi-source.json linguist-generated=true
 packages/stack/src/functions/generated/* text eol=lf linguist-generated=true
@@ -34,7 +30,6 @@ apps/docs/public/cli/project-config.schema.json linguist-generated=true
 # Lockfiles. Collapsed rather than hidden -- a dependency change is still one
 # click away in review, which is the same treatment GitHub gives package-lock.json.
 pnpm-lock.yaml linguist-generated=true
-apps/cli-go/go.sum linguist-generated=true
 
 # Not a language marker -- this is the service image manifest, not a container build.
 apps/cli/src/shared/services/Dockerfile linguist-detectable=false

.github/CODEOWNERS

@@ -10,15 +10,8 @@
 /tools/*/package.json @supabase/cli @supabase-oss
 /pnpm-lock.yaml @supabase/cli @supabase-oss
 /pnpm-workspace.yaml @supabase/cli @supabase-oss
-/apps/cli-go/go.mod @supabase/cli @supabase-oss
-/apps/cli-go/go.sum @supabase/cli @supabase-oss
-/apps/cli-go/pkg/go.mod @supabase/cli @supabase-oss
-/apps/cli-go/pkg/go.sum @supabase/cli @supabase-oss
 /apps/cli/src/shared/services/Dockerfile @supabase/cli @supabase-oss
-/apps/cli-go/pkg/config/templates/Dockerfile @supabase/cli @supabase-oss
 /packages/stack/src/Artifacts.ts @supabase/cli @supabase-oss
-/apps/cli-go/api/v1-openapi.yaml @supabase/cli @supabase-oss
-/apps/cli-go/pkg/api/*.gen.go @supabase/cli @supabase-oss
 /packages/api/src/generated/ @supabase/cli @supabase-oss
 /packages/api/scripts/openapi-source.json @supabase/cli @supabase-oss
 

.github/ISSUE_TEMPLATE/bug-report.yml

@@ -107,7 +107,7 @@ body:
     id: ticket-id
     attributes:
       label: Crash report ID
-      description: If the CLI printed one after rerunning with `--create-ticket`, paste the crash report ID.
+      description: If you have a crash report or support ticket ID, paste it here.
       placeholder: ab1ac733e31e4f928a4d7c8402543712
     validations:
       required: false

.github/actions/setup/action.yml

@@ -14,16 +14,10 @@ inputs:
       fails with a path validation error.
     required: false
     default: "true"
-  go-cache:
-    description: >-
-      Whether to restore the Go module and build caches. Disable this in jobs
-      that never run Go.
-    required: false
-    default: "true"
   tools:
     description: >-
       Space-separated mise tools to install instead of every tool in
-      mise.toml. Skipping the Go toolchain keeps the restored mise cache small.
+      mise.toml.
     required: false
     default: ""
   pnpm-store-cache:
@@ -189,41 +183,6 @@ runs:
         path: ${{ steps.pnpm-cache.outputs.path }}/lockfile-verified.jsonl
         key: pnpm-verify-${{ runner.os }}-${{ inputs.dependency-firewall-token != '' && 'firewall' || 'public' }}-${{ hashFiles('pnpm-lock.yaml', 'pnpm-workspace.yaml') }}
 
-    - name: Resolve Go cache paths
-      if: inputs.dependency-cache == 'true' && inputs.go-cache == 'true'
-      id: go-cache
-      shell: bash
-      run: |
-        echo "mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
-        echo "build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
-
-    - name: Mount Go module disk
-      if: inputs.dependency-cache == 'true' && inputs.go-cache == 'true' && steps.sticky.outputs.enabled == 'true'
-      uses: useblacksmith/stickydisk@b6cb58d1d31d6d32a25248fab12493d831f7bd48 # v1.7.2
-      with:
-        key: ${{ github.repository }}-go-mod-v3-${{ runner.arch }}
-        path: ${{ steps.go-cache.outputs.mod }}
-        commit: ${{ steps.sticky.outputs.commit }}
-
-    - name: Mount Go build disk
-      if: inputs.dependency-cache == 'true' && inputs.go-cache == 'true' && steps.sticky.outputs.enabled == 'true'
-      uses: useblacksmith/stickydisk@b6cb58d1d31d6d32a25248fab12493d831f7bd48 # v1.7.2
-      with:
-        key: ${{ github.repository }}-go-build-v3-${{ runner.arch }}
-        path: ${{ steps.go-cache.outputs.build }}
-        commit: ${{ steps.sticky.outputs.commit }}
-
-    - name: Configure Go dependency cache
-      if: inputs.dependency-cache == 'true' && inputs.go-cache == 'true' && steps.sticky.outputs.enabled != 'true'
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-      with:
-        path: |
-          ${{ steps.go-cache.outputs.mod }}
-          ${{ steps.go-cache.outputs.build }}
-        key: go-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('apps/cli-go/go.mod', 'apps/cli-go/go.sum') }}
-        restore-keys: |
-          go-cache-${{ runner.os }}-${{ runner.arch }}-
-
     - name: Install dependencies
       shell: bash
       env:

.github/dependabot.yml

@@ -37,28 +37,6 @@ updates:
         # — never bundle it into the actions-major group.
     cooldown:
       default-days: 7
-  - package-ecosystem: "gomod"
-    directories:
-      - "/apps/cli-go"
-      - "/apps/cli-go/pkg"
-    schedule:
-      interval: "cron"
-      cronjob: "0 0 * * *"
-    commit-message:
-      prefix: "chore(cli-go): "
-    groups:
-      go-minor:
-        update-types:
-          - minor
-          - patch
-        exclude-patterns:
-          - github.com/compose-spec/compose-go/v2
-    ignore:
-      - dependency-name: "github.com/compose-spec/compose-go/v2"
-      - dependency-name: "github.com/docker/cli"
-      - dependency-name: "github.com/docker/docker"
-    cooldown:
-      default-days: 7
   - package-ecosystem: "npm"
     directory: "/"
     schedule:

.github/workflows/build-cli-artifacts.yml

@@ -71,10 +71,6 @@ jobs:
         with:
           dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
 
-      - name: Pre-download Go modules
-        working-directory: apps/cli-go
-        run: go mod download -x
-
       - name: Install nfpm
         env:
           NFPM_VERSION: "2.47.0"
@@ -112,13 +108,47 @@ jobs:
 
       - name: Verify build artifacts
         run: |
+          set -euo pipefail
           for pkg in cli-darwin-arm64 cli-darwin-x64 cli-linux-arm64 cli-linux-arm64-musl cli-linux-x64 cli-linux-x64-musl cli-windows-arm64 cli-windows-x64; do
             echo "Checking packages/$pkg/bin/..."
             ls -la "packages/$pkg/bin/"
           done
           echo "Checking dist/..."
           ls -la dist/
 
+          # Every channel ships a single `supabase` binary; no `supabase-go` companion.
+          shopt -s nullglob
+          for f in packages/*/bin/supabase-go*; do
+            echo "::error::${f} is a supabase-go companion binary"
+            exit 1
+          done
+
+          check_listing() {
+            local artifact="$1"
+            shift
+            local listing
+            if ! listing="$("$@")"; then
+              echo "::error::failed to list the contents of ${artifact}"
+              exit 1
+            fi
+            if grep -q 'supabase-go' <<<"$listing"; then
+              echo "::error::${artifact} contains supabase-go"
+              exit 1
+            fi
+          }
+
+          for a in dist/*.tar.gz dist/*.apk; do check_listing "$a" tar -tzf "$a"; done
+          for a in dist/*.zip; do check_listing "$a" unzip -Z1 "$a"; done
+          for a in dist/*.deb; do check_listing "$a" dpkg-deb -c "$a"; done
+          rpms=(dist/*.rpm)
+          if [[ ${#rpms[@]} -gt 0 ]]; then
+            if command -v rpm >/dev/null; then
+              for a in "${rpms[@]}"; do check_listing "$a" rpm -qlp "$a"; done
+            else
+              echo "::notice::rpm is not installed on this runner; rpm contents were not checked for supabase-go"
+            fi
+          fi
+
       - name: Check existing build artifacts cache
         id: build-artifacts-cache
         uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0