Supabase CLI module

[github-actions[bot]]

A discussion dedicated to the Supabase CLI module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	20 / 20	20 / 20	10 / 10	93 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents six distinct modes with full Terraform examples: PAT (use_external_auth = false), OAuth/External Auth (use_external_auth = true), Project Dashboard Link (project_ref), Custom Install Method (install_method = "binary"), Pre-installed Binary / Air-gapped (skip_install = true), and Internal Mirror (download_base_url). Each has sensible defaults and clear usage context.
Visual preview	5	0	No image, GIF, or video is embedded in the README. The frontmatter icon field references an SVG for the module listing but is not a visual preview of the module in action. No  markdown image syntax present.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	access_token and db_password variables both have sensitive = true. The access_token output is also sensitive = true. README examples use var.supabase_token (declared sensitive = true) rather than inline literal keys. OAuth example uses <your-client-id> / <your-client-secret> placeholders for Coder admin env vars, not template-inline secrets.
Non-hardcoded auth path	4	4	README documents Coder External Auth (OAuth) as a complete alternative to pasting tokens: full CODER_EXTERNAL_AUTH_0_* environment variable setup, OAuth app creation instructions, and a Terraform example using use_external_auth = true with no raw keys in the template.

Restricted-Environment Readiness — 20 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	5	download_base_url variable (default https://github.com/supabase/cli/releases/download) is used directly in the install script to construct download URLs for both binary ($DOWNLOAD_BASE_URL/v$version/supabase_${OS}_${ARCH}.tar.gz) and native package ($DOWNLOAD_BASE_URL/v$version/supabase_${version}_${OS}_${ARCH}.deb) paths. README includes a "With Internal Mirror" example pointing to https://artifacts.internal.corp/supabase-cli/releases/download.
Bring-your-own binary	10	10	skip_install boolean variable (default false) is documented in README with a "Pre-installed Binary (Air-gapped / Golden Image)" example. The install script checks SKIP_INSTALL and skips the entire download/install block, then verifies the binary exists on PATH or in $BIN_DIR before proceeding to auth setup.
Egress transparency	3	3	Dedicated "## Network Egress" section enumerates five endpoint groups (api.github.com, github.com, api.supabase.com, supabase.com, Homebrew/Scoop repos) with purpose and timing (install vs. runtime). Includes explicit guidance for restricted environments: "set download_base_url to an internal mirror or use skip_install = true with a pre-baked image."
Runs without sudo	2	2	The binary install path (default fallback and the path used when no package manager is detected) never invokes sudo — it downloads to $HOME/.coder-modules/... and uses mkdir, tar, mv, chmod +x. The native package path uses sudo dpkg/rpm/apk but falls back to install_binary on failure or when sudo is absent. The script degrades gracefully when sudo is unavailable.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All 15 variables have type, description, and default (where applicable). install_method includes a validation block with contains() and a clear error_message. Sensitive variables (access_token, db_password) are marked. Descriptions explain purpose and usage context (e.g., use_external_auth notes the CLI may reject OAuth tokens).
Test coverage	4	4	main.tftest.hcl contains 15 test runs covering business logic: defaults, install method variants, version pinning, app URL construction (with/without project_ref), conditional app creation, skip_install, download_base_url, and pre/post install scripts. main.test.ts provides end-to-end tests: Terraform apply with variable validation, install method enforcement, skip_install behavior, download_base_url propagation, and actual binary installation in Ubuntu 22.04 and Debian Bookworm containers with version verification.

Overall — 93 / 100

Raw 62 / 67 → round(62 / 67 × 100) = 93

---

Scored against SCORECARD.md on 2026-10-19 with solstice-1.