[mdonnalley]

Summary

Adds a [db.migrations.checks] section to config.toml. Each of the nine migration security
rules gets a severity (error, warn or off), and [db.migrations.checks.exclude] lists
"schema.name" objects to skip per rule. Nothing reads the policy yet; the migration apply
path consumes it in a follow-up.

• Unknown rule names, invalid severities and malformed exclusion entries fail config loading
  with path-scoped messages, including a "did you mean" suggestion for misspelled rules. This
  section is stricter than the rest of the config so an older CLI never ignores a rule a
  teammate set.
• An absent section leaves every rule unset; the CLI resolver treats unset rules as warn.
• The section is published in the CLI config JSON Schema. CliConfig gains
  db.migrations.checks; the new constants are exported from @supabase/config/internal only.

Linked issue

Closes CLI-2782
Closes CLI-2783
Part of CLI-2786
Part of CLI-2787

[github-actions]

🤖 AI Review

Verified all four findings from both completed reviews. Confirmed the Go configuration compatibility regression, silent acceptance of non-table exclusions, and a documentation nit. Whitespace acceptance is verified, but whether it violates the intended naming contract remains uncertain. No findings overlap.

Findings

Severity	Location	Category	Sources	Claim
🔴 CRITICAL	packages/config/src/db.ts:154	compatibility	claude	Using the newly advertised db.migrations.checks section breaks Go-delegated commands that load project configuration, including db diff --use-pg-schema.
🟡 MINOR	packages/config/src/db-migration-checks.ts:125	config-validation	codex	Non-table objects such as Date instances can be silently accepted as an empty exclusion table.
⚪ NIT	packages/config/src/db-migration-checks.ts:50	validation	claude	The object-name pattern permits whitespace immediately before the separator, potentially allowing typoed exclusions such as public .countries.
⚪ NIT	packages/config/src/db-migration-checks.ts:81	docs	claude	The published description's wording, "Runs against --db-url read this section from config.toml only," is awkward and could be clearer.

Stats

Claude findings: 3 · Codex findings: 1 · Confirmed: 3 · Refuted: 0 · Uncertain: 1

---

Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.