[mdonnalley]

supabase init can write a [db.migrations.checks] section to config.toml when SUPABASE_EXPERIMENTAL_MIGRATION_CHECKS is set to a true value (1, true, ...). The section sets every security rule to warn, explains what error, warn and off do, and includes a commented-out [db.migrations.checks.exclude] example. Without the variable, init writes the same config.toml as before.

The variable is shell-only and has no config key, so the feature can be dogfooded without changing customer output. bootstrap honours it on the blank template path, since that path runs the same init.

[github-actions]

🤖 AI Review

Both independent reviews were available; Codex reported no findings. Code inspection confirms Claude’s two documentation correctness issues and one wording nit. The generated configuration advertises migration-check enforcement and a baseline command that are not implemented in this checkout.

Findings

Severity	Location	Category	Sources	Claim
🟡 MINOR	apps/cli/src/shared/init/project-init.templates.ts:71	documentation	claude	The generated config incorrectly promises security checks on every migration and blocking rollback for rules set to "error". Users following this guidance receive no such protection in this checkout.
🟡 MINOR	apps/cli/src/shared/init/project-init.templates.ts:85	documentation	claude	The generated config recommends supabase db advisors --baseline, but that command does not support a baseline flag or populate migration-check exclusions.
⚪ NIT	apps/cli/src/shared/init/project-init.templates.ts:72	documentation	claude	The phrase "while we measure false positives" embeds temporary team rollout context in users’ persistent configuration files.

Stats

Claude findings: 3 · Codex findings: 0 · Confirmed: 3 · Refuted: 0 · Uncertain: 0

---

Models: claude-opus-5-5 + gpt-6.1-sol · Trigger: auto · Workflow run

This review runs once per PR. A maintainer can request another with a /ai-review comment.

[avallete]

Sorry, pending this until we have the clear on M0 for this.

Don't wanna merge it yet since it's customer facing, for any supabase init. I think this should be hidden behind a feature flag so we can dogfood and ship the code but not change the customer output yet.