mirror of
https://github.com/supabase/supabase.git
synced 2026-09-10 03:51:51 +08:00
2681a21f5c
Add a guide that compares classic and scoped personal access tokens, explains how account roles constrain token permissions, and walks through creating and testing a project-scoped token. Include generated tables mapping permissions to Management API endpoints and MCP tools, and link the guide from docs navigation and Studio token sheets. Move the scoped-token permission catalog from Studio into shared-data. Studio and docs generation now share permission names, categories, descriptions, risk metadata, modes, scopes, and display order. Generate the tables from the shared catalog, OpenAPI x-fga-permissions, and the downloaded MCP permission map. Exclude Workers permissions until the feature is live. Run regeneration through the docs Makefile, verify checked-in output in CI, and refresh it in the weekly Management API workflow. Add Dashboard and Docs ownership plus contributor guidance so permission changes stay synchronized.
139 lines
4.4 KiB
YAML
139 lines
4.4 KiB
YAML
name: Docs Tests
|
|
|
|
on:
|
|
pull_request:
|
|
branches: ['master']
|
|
paths:
|
|
- 'apps/docs/**/*.ts*'
|
|
- 'apps/docs/spec/**/*.json'
|
|
- 'apps/docs/spec/Makefile'
|
|
- 'apps/docs/spec/sections/generateAccessControlPartials.mts'
|
|
- 'apps/docs/content/_partials/access-control/**'
|
|
- 'apps/docs/.env.development'
|
|
- 'apps/docs/package.json'
|
|
- 'packages/shared-data/package.json'
|
|
- 'packages/shared-data/scoped-access-token-permissions.ts'
|
|
- 'e2e/docs/local-smoke/**'
|
|
- 'e2e/docs/playwright.local-smoke.config.ts'
|
|
- 'e2e/docs/package.json'
|
|
|
|
# Cancel old builds on new commit for same workflow + branch/PR
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
env:
|
|
CI: true
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: blacksmith-4vcpu-ubuntu-2404
|
|
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
sparse-checkout: |
|
|
apps/docs
|
|
examples
|
|
packages
|
|
supabase
|
|
patches
|
|
|
|
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
|
|
name: Install pnpm
|
|
with:
|
|
run_install: false
|
|
|
|
- name: Use Node.js
|
|
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version-file: '.nvmrc'
|
|
cache: 'pnpm'
|
|
|
|
- name: Install deps
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Check access-control partials
|
|
run: |
|
|
make -C apps/docs/spec generate.partials.access-control
|
|
git diff --exit-code -- \
|
|
apps/docs/content/_partials/access-control/scoped_pat_permissions.mdx \
|
|
apps/docs/content/_partials/access-control/scoped_pat_mcp_tools.mdx
|
|
|
|
- name: Download JS reference TypeDoc dumps
|
|
# The source dumps under apps/docs/spec/reference/<lib>/<ver>/*.json are
|
|
# gitignored — `make download.tsdoc.v2` re-fetches them from
|
|
# supabase.github.io so the reference-content snapshot test has
|
|
# something to walk.
|
|
working-directory: apps/docs/spec
|
|
run: make download.tsdoc.v2
|
|
|
|
- name: Generate Dart reference dump
|
|
# Dart has no upstream TypeDoc dump; its gitignored dump is generated
|
|
# from the committed `supabase_dart_v2.yml` so the reference-content
|
|
# snapshot test has something to walk.
|
|
working-directory: apps/docs
|
|
run: pnpm run codegen:references:dart
|
|
|
|
- name: Run tests
|
|
run: |
|
|
touch .env
|
|
# Needed to prevent local Supabase startup from erroring, due to
|
|
# GitHub Auth being enabled in config
|
|
echo "GITHUB_CLIENT_ID=dummy-id" >> .env
|
|
echo "GITHUB_SECRET=dummy-secret" >> .env
|
|
pnpm run test:docs
|
|
|
|
local-dev-smoke:
|
|
name: Local dev smoke (no credentials)
|
|
runs-on: blacksmith-4vcpu-ubuntu-2404
|
|
|
|
steps:
|
|
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
|
|
with:
|
|
persist-credentials: false
|
|
sparse-checkout: |
|
|
apps/docs
|
|
examples
|
|
packages
|
|
supabase
|
|
patches
|
|
e2e/docs
|
|
|
|
- uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
|
|
name: Install pnpm
|
|
with:
|
|
run_install: false
|
|
|
|
- name: Use Node.js
|
|
uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
|
|
with:
|
|
node-version-file: '.nvmrc'
|
|
cache: 'pnpm'
|
|
|
|
- name: Install deps
|
|
run: pnpm install --frozen-lockfile
|
|
|
|
- name: Install Playwright Chromium
|
|
run: pnpm -C e2e/docs exec playwright install chromium --with-deps --only-shell
|
|
|
|
# Deliberately does not set DOCS_GITHUB_APP_*, SUPABASE_SECRET_KEY,
|
|
# OPENAI_API_KEY, or DOCS_REVALIDATION_KEYS — their absence here is what
|
|
# verifies `pnpm run dev:docs` still works without private credentials.
|
|
- name: Run local dev smoke tests
|
|
run: pnpm run e2e:docs:local-smoke
|
|
|
|
- name: Upload Playwright report
|
|
if: failure()
|
|
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
|
|
with:
|
|
name: docs-local-smoke-playwright-report
|
|
path: |
|
|
e2e/docs/playwright-report-local-smoke/
|
|
e2e/docs/test-results/
|
|
retention-days: 7
|