🔄 Sync with upstream changes

.formatter.exs

@@ -1,7 +1,7 @@
 [
   import_deps: [:ecto, :ecto_sql, :phoenix, :open_api_spex],
   subdirectories: ["priv/*/migrations"],
-  plugins: [Phoenix.LiveView.HTMLFormatter],
+  plugins: [],
   inputs: ["*.{heex,ex,exs}", "{config,lib,test}/**/*.{heex,ex,exs}", "priv/*/*seeds*.exs"],
   line_length: 120
 ]

.github/actionlint.yaml

@@ -0,0 +1,6 @@
+self-hosted-runner:
+  labels:
+    - blacksmith-2vcpu-ubuntu-2404
+    - blacksmith-4vcpu-ubuntu-2404
+    - blacksmith-8vcpu-ubuntu-2404
+    - blacksmith-4vcpu-ubuntu-2404-arm

.github/workflows/dispatch_deploy.yml

@@ -0,0 +1,52 @@
+name: Dispatch Deploy
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version to deploy (no leading v). Leave blank to let the downstream pick the latest release. Example: 2.94.1'
+        required: false
+        type: string
+  workflow_call:
+    inputs:
+      version:
+        description: 'Version to deploy (no leading v).'
+        required: true
+        type: string
+
+permissions: {}
+
+jobs:
+  dispatch:
+    runs-on: blacksmith-2vcpu-ubuntu-2404
+    steps:
+      - name: Fetch target repo
+        id: target
+        env:
+          TARGET_REPO: ${{ secrets.DEPLOY_TARGET_REPO }}
+        run: |
+          name="${TARGET_REPO##*/}"
+          echo "::add-mask::${name}"
+          echo "name=${name}" >> "$GITHUB_OUTPUT"
+
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ secrets.GH_APP_MANAGER_ID }}
+          private-key: ${{ secrets.GH_APP_MANAGER_PRIVATE_KEY }}
+          owner: supabase
+          repositories: ${{ steps.target.outputs.name }}
+
+      - name: Dispatch version update
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          TARGET_REPO: ${{ secrets.DEPLOY_TARGET_REPO }}
+          VERSION: ${{ inputs.version }}
+          SOURCE: ${{ github.event_name == 'workflow_dispatch' && 'manual-dispatch' || 'realtime-release' }}
+        run: |
+          gh api "repos/${TARGET_REPO}/dispatches" \
+            --method POST \
+            --field event_type=realtime-release \
+            --field "client_payload[version]=${VERSION}" \
+            --field "client_payload[source]=${SOURCE}"

.github/workflows/docker-build.yml

@@ -0,0 +1,44 @@
+name: Docker Build
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  docker_x86_build:
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+    timeout-minutes: 120
+    env:
+      arch: amd64
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Setup Blacksmith Builder
+        uses: useblacksmith/setup-docker-builder@ef12d5b165b596e3aa44ea8198d8fde563eab402 # v1.4.0
+
+      - uses: useblacksmith/build-push-action@30c71162f16ea2c27c3e21523255d209b8b538c1 # v2
+        with:
+          context: .
+          push: false
+          platforms: linux/${{ env.arch }}
+
+  docker_arm_build:
+    runs-on: blacksmith-4vcpu-ubuntu-2404-arm
+    timeout-minutes: 120
+    env:
+      arch: arm64
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Setup Blacksmith Builder
+        uses: useblacksmith/setup-docker-builder@ef12d5b165b596e3aa44ea8198d8fde563eab402 # v1.4.0
+
+      - uses: useblacksmith/build-push-action@30c71162f16ea2c27c3e21523255d209b8b538c1 # v2
+        with:
+          context: .
+          push: false
+          platforms: linux/${{ env.arch }}

.github/workflows/fix-nix-hash.yml

@@ -0,0 +1,99 @@
+name: Fix Nix Hash
+
+on:
+  pull_request:
+    paths:
+      - "test/e2e/flake.nix"
+      - "test/e2e/flake.lock"
+      - "test/e2e/bun.lock"
+      - "test/e2e/package.json"
+      - "test/e2e/nix-build.sh"
+      - ".github/workflows/fix-nix-hash.yml"
+
+permissions:
+  contents: read # push uses GH_AUTOFIX app token, not GITHUB_TOKEN
+
+concurrency:
+  group: fix-nix-hash-${{ github.head_ref }}
+  cancel-in-progress: true
+
+jobs:
+  fix-nix-hash:
+    name: Validate and Fix Nix Hash
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    outputs:
+      changed: ${{ steps.check-changes.outputs.changed }}
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
+
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@da36cb69b1c3247ad7a1f931ebfd954a1105ef14 # v14
+
+      - name: Fix Nix hash
+        working-directory: test/e2e
+        run: bash nix-build.sh
+
+      - name: Check if hash was updated
+        id: check-changes
+        run: |
+          if git diff --quiet test/e2e/flake.nix; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Upload updated hash
+        if: steps.check-changes.outputs.changed == 'true'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        with:
+          name: updated-nix-hash
+          path: test/e2e/flake.nix
+          retention-days: 1
+
+  push-nix-hash:
+    name: Commit Fixed Nix Hash
+    needs: fix-nix-hash
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    if: needs.fix-nix-hash.outputs.changed == 'true'
+
+    steps:
+      - name: Generate token
+        id: app-token
+        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        with:
+          app-id: ${{ secrets.GH_AUTOFIX_APP_ID }}
+          private-key: ${{ secrets.GH_AUTOFIX_PRIVATE_KEY }}
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.head_ref }}
+          persist-credentials: false
+
+      - name: Download updated hash
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+        with:
+          name: updated-nix-hash
+          path: test/e2e
+
+      - name: Commit and push updated hash
+        env:
+          APP_TOKEN: ${{ steps.app-token.outputs.token }}
+          TARGET_BRANCH: ${{ github.head_ref }}
+        run: |
+          /usr/bin/git config --local user.name "supabase-autofix-bot"
+          /usr/bin/git config --local user.email "noreply@supabase.com"
+          /usr/bin/git add test/e2e/flake.nix
+
+          if /usr/bin/git diff --cached --quiet; then
+            exit 0
+          fi
+
+          /usr/bin/git commit -m "chore: update nix node_modules hash"
+          /usr/bin/git -c credential.helper= push "https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${TARGET_BRANCH}"

.github/workflows/forum_tests.yml

@@ -0,0 +1,56 @@
+name: Forum Tests
+defaults:
+  run:
+    shell: bash
+    working-directory: ./forum
+on:
+  pull_request:
+    paths:
+      - "forum/**"
+      - ".github/workflows/forum_tests.yml"
+
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  MIX_ENV: test
+
+jobs:
+  tests:
+    name: Tests & Lint
+    runs-on: blacksmith-4vcpu-ubuntu-2404
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Setup elixir
+        id: beam
+        uses: erlef/setup-beam@ee09b1e59bb240681c382eb1f0abc6a04af72764 # v1.23.0
+        with:
+          otp-version: 27.x # Define the OTP version [required]
+          elixir-version: 1.18.x # Define the elixir version [required]
+      - name: Cache Mix
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        with:
+          path: |
+            forum/deps
+            forum/_build
+          key: ${{ github.workflow }}-${{ runner.os }}-mix-${{ steps.beam.outputs.elixir-version }}-${{ steps.beam.outputs.otp-version }}-${{ hashFiles('forum/mix.lock') }}
+          restore-keys: |
+            ${{ github.workflow }}-${{ runner.os }}-mix-${{ steps.beam.outputs.elixir-version }}-${{ steps.beam.outputs.otp-version }}-
+      - name: Install dependencies
+        run: mix deps.get
+      - name: Start epmd
+        run: epmd -daemon
+      - name: Run tests
+        run: MIX_ENV='test' mix test
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Check for warnings
+        run: mix compile --force --warnings-as-errors
+      - name: Run format check
+        run: mix format --check-formatted

.github/workflows/integration_tests.yml

@@ -0,0 +1,88 @@
+name: Integration Tests
+on:
+  pull_request:
+    paths:
+      - "lib/**"
+      - "test/**"
+      - "config/**"
+      - "priv/**"
+      - "assets/**"
+      - "rel/**"
+      - "mix.exs"
+      - "mix.lock"
+      - "Dockerfile"
+      - "run.sh"
+      - "docker-compose.test.yml"
+      - ".github/workflows/integration_tests.yml"
+
+  push:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+env:
+  DENO_IMAGE: denoland/deno:alpine-2.5.6
+
+jobs:
+  tests:
+    name: Tests (${{ matrix.postgres }})
+    runs-on: blacksmith-8vcpu-ubuntu-2404
+    env:
+      POSTGRES_IMAGE: ${{ matrix.postgres_image }}
+      DB_USER_REALTIME: ${{ matrix.db_user_realtime }}
+    strategy:
+      fail-fast: false
+      matrix:
+        postgres: [pg14, pg15, pg15_latest, pg17]
+        include:
+          - postgres: pg14
+            postgres_image: supabase/postgres:14.1.0.82
+            db_user_realtime: supabase_admin
+          # test before supautils.policy_grants added all necessary grants
+          - postgres: pg15
+            postgres_image: supabase/postgres:15.1.0.1
+            db_user_realtime: supabase_admin
+          - postgres: pg15_latest
+            postgres_image: supabase/postgres:15.14.1.129
+            db_user_realtime: supabase_realtime_admin
+          - postgres: pg17
+            postgres_image: supabase/postgres:17.6.1.127
+            db_user_realtime: supabase_realtime_admin
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Cache Docker images
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        id: docker-cache
+        with:
+          path: /tmp/docker-images
+          key: docker-images-integration-zstd-${{ env.POSTGRES_IMAGE }}-${{ env.DENO_IMAGE }}
+      - name: Load Docker images from cache
+        if: steps.docker-cache.outputs.cache-hit == 'true'
+        run: |
+          zstd -d --stdout /tmp/docker-images/postgres.tar.zst | docker image load &
+          PID1=$!
+          zstd -d --stdout /tmp/docker-images/deno.tar.zst | docker image load &
+          PID2=$!
+          wait $PID1 || exit $?
+          wait $PID2 || exit $?
+      - name: Pull and save Docker images
+        if: steps.docker-cache.outputs.cache-hit != 'true'
+        run: |
+          docker pull ${{ env.POSTGRES_IMAGE }} &
+          PID1=$!
+          docker pull ${{ env.DENO_IMAGE }} &
+          PID2=$!
+          wait $PID1 || exit $?
+          wait $PID2 || exit $?
+          mkdir -p /tmp/docker-images
+          docker image save ${{ env.POSTGRES_IMAGE }} | zstd -T0 -o /tmp/docker-images/postgres.tar.zst
+          docker image save ${{ env.DENO_IMAGE }} | zstd -T0 -o /tmp/docker-images/deno.tar.zst
+      - name: Run integration test
+        run: docker compose -f compose.tests.yml up --abort-on-container-exit --exit-code-from test-runner