Supabase CLI module

[github-actions[bot]]

A discussion dedicated to the Supabase CLI module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	20 / 20	19 / 20	10 / 10	91 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README documents PAT auth, OAuth external-auth, project-linked dashboard, custom install method, pre-installed binary (air-gapped), and internal mirror — each with a working tf snippet and sensible defaults.
Visual preview	5	0	No image, GIF, or video embedded in the README; only an icon reference in frontmatter.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	access_token and db_password both declared sensitive = true in main.tf. All README usage examples pass secrets via var.supabase_token (a separately declared sensitive variable) rather than inline literals; a > [!NOTE] Never hardcode tokens callout reinforces this.
Non-hardcoded auth path	4	4	Dedicated "Coder External Auth (OAuth)" section documents configuring Supabase as an external auth provider with full CODER_EXTERNAL_AUTH_* env var setup, avoiding pasted keys.

Restricted-Environment Readiness — 19 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	5	download_base_url variable (default https://github.com/supabase/cli/releases/download) is interpolated directly into the binary/package download URL in install.sh.tftpl (DOWNLOAD_URL="${DOWNLOAD_BASE_URL}/v${version}/..."), and a "With Internal Mirror" README example demonstrates overriding it.
Bring-your-own binary	10	10	skip_install variable documented with a "Pre-installed Binary (Air-gapped / Golden Image)" example; script short-circuits install and only configures auth/env when set.
Egress transparency	3	3	Dedicated "Network Egress" section lists concrete endpoints (api.github.com, github.com, api.supabase.com, supabase.com, Homebrew/Scoop repos) with purpose/timing, plus a note on using download_base_url/skip_install for restricted environments.
Runs without sudo	2	1	install_native_package invokes sudo dpkg/rpm/apk when available; if sudo is absent it attempts the same command unprivileged (likely to fail) and falls back to install_binary (no sudo). This is sudo-for-optional-path-with-fallback, which the rubric caps at half.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All variables have clear descriptions and sensible defaults (detect, latest, empty strings for optional secrets); install_method has a validation block restricting to allowed values.
Test coverage	4	4	main.tftest.hcl covers variable plumbing, conditional coder_app creation, and business logic across many configurations; main.test.ts adds real container-based end-to-end install verification (Ubuntu/Debian binary install, PATH symlink, install-method matrix).

Overall — 91 / 100

Raw 61 / 67 → round(61 / 67 × 100) = 91

---

Scored against SCORECARD.md on 2026-10-05 with solstice-1.