Supabase CLI module

[github-actions[bot]]

A discussion dedicated to the Supabase CLI module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	20 / 20	20 / 20	10 / 10	93 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents every major mode with a dedicated Terraform example: PAT auth (use_external_auth = false), OAuth/external auth (use_external_auth = true), project dashboard link (project_ref), custom install method (install_method = "binary"), pre-installed binary (skip_install = true), and internal mirror (download_base_url). An install-method comparison table covers detect/brew/scoop/binary with platform support.
Visual preview	5	0	No embedded image, GIF, or video in the README. The frontmatter references an SVG icon (icon: ../../../../.icons/supabase.svg), but icons do not count per calibration.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	access_token and db_password variables both have sensitive = true. The access_token output is also sensitive = true. README Terraform examples use var.supabase_token (a variable reference) rather than inline literal keys. A > [!NOTE] Never hardcode tokens in your template. callout reinforces the practice.
Non-hardcoded auth path	4	4	README documents Coder External Auth (OAuth) as a first-class path: full CODER_EXTERNAL_AUTH_0_* env-var block, Supabase OAuth app creation instructions, and a Terraform example using use_external_auth = true with external_auth_id. This avoids pasting raw keys into templates.

Restricted-Environment Readiness — 20 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	5	download_base_url variable (default https://github.com/supabase/cli/releases/download) is interpolated into the binary and native-package download URLs in install.sh.tftpl. README "With Internal Mirror" example shows overriding it to https://artifacts.internal.corp/supabase-cli/releases/download.
Bring-your-own binary	10	10	skip_install variable (default false) skips the entire download/install block. README "Pre-installed Binary (Air-gapped / Golden Image)" section documents skip_install = true. The script still locates the binary via command -v supabase or $BIN_DIR/supabase and proceeds to auth/link steps.
Egress transparency	3	3	Dedicated "## Network Egress" section enumerates five endpoint groups (api.github.com, github.com, api.supabase.com, supabase.com, Homebrew/Scoop repos) with purpose and timing columns, plus a closing note on restricted-environment workarounds (download_base_url, skip_install).
Runs without sudo	2	2	Binary install path (the default fallback) uses only $HOME-scoped directories and user profile edits—no sudo. Native-package install invokes sudo dpkg/rpm/apk but wraps it in a command -v sudo check and falls back to install_binary on failure. The script degrades gracefully when sudo is absent.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All 15 variables carry description and sensible default values. install_method includes a validation block with contains([...]) and a clear error_message. access_token and db_password are sensitive = true. use_external_auth description includes a practical caveat about OAuth token format rejection.
Test coverage	4	4	main.tftest.hcl (15 runs) covers business logic: variable defaults, install-method pass-through, app URL construction with/without project_ref, conditional coder_app creation, skip_install, and download_base_url. main.test.ts covers end-to-end behavior: required-variable rejection, install-method validation, actual binary installation in Ubuntu 22.04 and Debian Bookworm containers, CODER_SCRIPT_BIN_DIR symlink creation, and skip_install script content.

Overall — 93 / 100

Raw 62 / 67 → round(62 / 67 × 100) = 93

---

Scored against SCORECARD.md on 2026-09-28 with solstice-1.