fix(ci): typecheck auto-synced Supabase types before pushing to main

[posthog-eu]

Summary

• The sync_schema_types job regenerates Supabase types from prod and pushed them straight to main with [skip ci] and no typecheck — so drift that doesn't compile lands unverified and reddens main for the next contributor (who eats a lint/typecheck failure they didn't cause).
• Prod is often behind local migrations, so a regeneration can drop columns the backend still references. This has rewritten the devices types region on ≥5 occasions since March; one (454a345cc) broke bun typecheck on plain main and needed a reactive cleanup PR (fix(types): restore device country code #2659).
• No user impact ([skip ci] also means no deploy fires) — the cost is entirely on engineers blocked by a red main.

Fix — gate the job on its own output:

+      - name: Install dependencies
+        run: bun install --frozen-lockfile
       - name: Sync generated schema and types
         ...
           BRANCH=main bun types
           ...drift check...
+          # Verify the regenerated types still compile against the backend
+          bun typecheck
           git add ...
-          git commit -m "chore(auto-sync): update supabase schema and generated types [skip ci]"
+          git commit -m "chore(auto-sync): update supabase schema and generated types"

• Runs bun typecheck only when drift is detected, before the commit — the default bash -eo pipefail shell fails the job (and skips the push) when the types don't compile.
• Adds bun install --frozen-lockfile because typecheck needs deps.
• Drops [skip ci]: the commit is now verified in-job before it lands.

Note

tests.yml uses branches-ignore: [main, development] for push, so it does not run on a direct push to main. The reliable protection is therefore the in-job typecheck gate, not the [skip ci] removal. Dropping the tag newly triggers only codspeed.yml (push-to-main benchmarks) on the auto-sync commit; it does not re-trigger this workflow (all jobs already skip chore(auto-sync): commits) and no deploy fires (build_and_deploy.yml runs on tags only).

This does not fix the underlying drift (prod schema behind local migrations) — it stops that drift from landing unverified.

Test plan

• CI-only change; verify by triggering a migration change on main and confirming the job fails rather than pushing when regenerated types don't compile.
• YAML parses and job structure is unchanged apart from the added step and typecheck.

Screenshots

N/A — CI workflow change.

Checklist

• My code follows the code style of this project and passes
  bun run lint:backend && bun run lint.
• My change requires a change to the documentation.
• I have updated the documentation
  accordingly.
• My change has adequate E2E test coverage.
• I have tested my code manually, and I have provided steps how to reproduce
  my tests

---

Created with PostHog Desktop from this inbox report.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud