Install Supabase CLI from npm

.github/workflows/ci.yml

@@ -46,13 +46,12 @@ jobs:
       fail-fast: false
       matrix:
         os: [macos-latest, windows-latest, ubuntu-latest]
-        version: [1.0.0, latest]
+        version: [1.178.2, latest, beta]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./
         with:
           version: ${{ matrix.version }}
-          github-token: ${{ github.token }}
       - run: supabase -h
 
   ci:

.github/workflows/e2e.yml

@@ -47,6 +47,8 @@ jobs:
         exclude:
           - version: 1.178.2
             pg_major: 17
+          - version: latest
+            pg_major: 14
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:

README.md

@@ -24,30 +24,58 @@ Setup the `supabase` CLI:
 
 ```yaml
 steps:
-  - uses: supabase/setup-cli@v2
+  - uses: supabase/setup-cli@v3
 ```
 
 If `version` is omitted, the action checks the repository root for `bun.lock`,
-`pnpm-lock.yaml`, or `package-lock.json` and uses the declared `supabase`
-version. If no supported lockfile is present, it falls back to `latest`.
+`pnpm-lock.yaml`, or `package-lock.json` and installs the declared `supabase`
+package version through npm. If the lockfile includes package integrity
+metadata, the action verifies it against the npm registry before installing. If
+no supported lockfile is present, it falls back to `latest`.
 
-A specific version of the `supabase` CLI can be installed:
+The action uses an existing Node.js/npm runtime when one is already available,
+and requires Node.js 20 or newer. On non-musl runners without Node.js or npm, it
+provisions them internally. Runners must be able to reach the npm registry to
+install the CLI package.
+
+When running in Alpine or other Linux musl containers, the action uses Alpine's
+`nodejs` and `npm` packages instead of `actions/setup-node`, because the
+standard Node.js runner binaries target glibc. Root containers can have missing
+runtime packages installed automatically. Non-root containers must include
+Node.js 20+ and the runtime packages in the image before the action runs:
+
+```dockerfile
+FROM alpine:3.20
+
+RUN apk add --no-cache libstdc++ libgcc nodejs npm
+
+USER 1000:1000
+```
+
+A fixed npm-published version, `latest`, or `beta` of the `supabase` CLI can be
+installed:
 
 ```yaml
 steps:
-  - uses: supabase/setup-cli@v2
+  - uses: supabase/setup-cli@v3
     with:
       version: 2.84.2
 ```
 
+```yaml
+steps:
+  - uses: supabase/setup-cli@v3
+    with:
+      version: beta
+```
+
 Run `supabase db start` to execute all migrations on a fresh database:
 
 ```yaml
 steps:
-  - uses: supabase/setup-cli@v2
+  - uses: supabase/setup-cli@v3
     with:
       version: latest
-      github-token: ${{ github.token }}
   - run: supabase init
   - run: supabase db start
 ```
@@ -59,18 +87,17 @@ on Windows and macOS runners.
 
 The action supports the following inputs:
 
-| Name           | Type   | Description                                                                | Default                           | Required |
-| -------------- | ------ | -------------------------------------------------------------------------- | --------------------------------- | -------- |
-| `version`      | String | Supabase CLI version (or `latest`)                                         | Root lockfile version or `latest` | false    |
-| `github-token` | String | GitHub token used to resolve `latest` without unauthenticated API limiting |                                   | false    |
+| Name      | Type   | Description                                                      | Default                           | Required |
+| --------- | ------ | ---------------------------------------------------------------- | --------------------------------- | -------- |
+| `version` | String | Supabase CLI `latest`, `beta`, or fixed version published to npm | Root lockfile version or `latest` | false    |
 
 ## Advanced Usage
 
 Check generated TypeScript types are up-to-date with Postgres schema:
 
 ```yaml
 steps:
-  - uses: supabase/setup-cli@v2
+  - uses: supabase/setup-cli@v3
   - run: supabase init
   - run: supabase db start
   - name: Verify generated types match Postgres schema
@@ -93,7 +120,7 @@ env:
   PROJECT_ID: <project-id>
 
 steps:
-  - uses: supabase/setup-cli@v2
+  - uses: supabase/setup-cli@v3
   - run: supabase link --project-ref $PROJECT_ID
   - run: supabase db push
 ```
@@ -102,7 +129,7 @@ Export local Supabase env vars for app tests:
 
 ```yaml
 steps:
-  - uses: supabase/setup-cli@v2
+  - uses: supabase/setup-cli@v3
   - run: supabase init
   - run: supabase start
   - name: Export local Supabase env vars
@@ -147,7 +174,7 @@ need to perform a few setup steps before you can work on the action.
 ## Publish
 
 1. Create a new GitHub release
-2. Rebase `v2` branch on `main`
+2. Rebase `v3` branch on `main`
 
 Your action is now published! :rocket:
 
@@ -164,7 +191,6 @@ steps:
   - uses: ./
     with:
       version: latest
-      github-token: ${{ github.token }}
 ```
 
 The CI workflow provides fast smoke coverage across GitHub-hosted runners, and

action.yml

@@ -3,10 +3,7 @@ description: Setup Supabase CLI, supabase, on GitHub Actions runners
 author: Supabase
 inputs:
   version:
-    description: Version of Supabase CLI to install. If omitted, detect from the root lockfile and otherwise use latest.
-    required: false
-  github-token:
-    description: GitHub token used to resolve the latest Supabase CLI release without hitting unauthenticated API limits.
+    description: Supabase CLI version to install. Supports latest, beta, or a fixed version published to npm. If omitted, detect from the root lockfile and otherwise use latest.
     required: false
 outputs:
   version:
@@ -22,18 +19,19 @@ runs:
       run: |
         set -eu
 
-        if [ "${RUNNER_OS}" != "Linux" ]; then
-          exit 0
-        fi
-
-        # setup-bun does not detect Linux musl yet, so Alpine-like containers need the musl asset explicitly.
         is_musl=false
-        if [ -f /etc/alpine-release ]; then
-          is_musl=true
-        elif command -v ldd >/dev/null 2>&1 && ldd --version 2>&1 | grep -qi musl; then
-          is_musl=true
+
+        if [ "${RUNNER_OS}" = "Linux" ]; then
+          # setup-bun does not detect Linux musl yet, so Alpine-like containers need the musl asset explicitly.
+          if [ -f /etc/alpine-release ]; then
+            is_musl=true
+          elif command -v ldd >/dev/null 2>&1 && ldd --version 2>&1 | grep -qi musl; then
+            is_musl=true
+          fi
         fi
 
+        echo "is-musl=${is_musl}" >> "$GITHUB_OUTPUT"
+
         if [ "${is_musl}" != "true" ]; then
           exit 0
         fi
@@ -55,25 +53,15 @@ runs:
       run: |
         set -eu
 
-        if [ "${RUNNER_OS}" != "Linux" ]; then
+        if [ "${{ steps.bun-download.outputs.is-musl }}" != "true" ]; then
           exit 0
         fi
 
-        is_musl=false
-        if [ -f /etc/alpine-release ]; then
-          is_musl=true
-        elif command -v ldd >/dev/null 2>&1 && ldd --version 2>&1 | grep -qi musl; then
-          is_musl=true
-        fi
-
-        if [ "${is_musl}" != "true" ]; then
-          exit 0
-        fi
-
-        # Bun's musl binary and the Supabase CLI shim both dynamically link libstdc++ and libgcc.
+        # Alpine/musl containers need runtime packages for Bun and the npm CLI shim.
+        # actions/setup-node uses glibc Node builds, so install Alpine's Node/npm instead.
         if command -v apk >/dev/null 2>&1; then
           missing_packages=""
-          for package in libstdc++ libgcc; do
+          for package in libstdc++ libgcc nodejs npm; do
             if ! apk info -e "${package}" >/dev/null 2>&1; then
               missing_packages="${missing_packages} ${package}"
             fi
@@ -92,9 +80,63 @@ runs:
           exit 0
         fi
 
-        echo "::error::Linux musl containers need libstdc++ and libgcc to run Supabase CLI. Install them before supabase/setup-cli."
+        echo "::error::Linux musl containers need libstdc++, libgcc, nodejs, and npm to run Supabase CLI. Install them before supabase/setup-cli."
         exit 1
 
+    - id: node-runtime
+      name: Resolve Node Runtime
+      shell: sh
+      run: |
+        set -eu
+
+        node_version=""
+        node_major=""
+        has_npm=false
+
+        if command -v node >/dev/null 2>&1; then
+          node_version="$(node -p 'process.versions.node' 2>/dev/null || true)"
+          node_major="${node_version%%.*}"
+        fi
+
+        if command -v npm >/dev/null 2>&1; then
+          has_npm=true
+        fi
+
+        if [ -n "${node_version}" ] && [ "${has_npm}" = "true" ]; then
+          case "${node_major}" in
+            ''|*[!0-9]*)
+              echo "::error::Could not determine Node.js version from '${node_version}'. Supabase CLI npm installs require Node.js 20 or newer."
+              exit 1
+              ;;
+          esac
+
+          if [ "${node_major}" -lt 20 ]; then
+            echo "::error::Supabase CLI npm installs require Node.js 20 or newer, but found Node.js ${node_version}. Set up Node.js 20+ before supabase/setup-cli, or use a runner image with Node.js 20+ and npm."
+            exit 1
+          fi
+
+          echo "setup-node=false" >> "$GITHUB_OUTPUT"
+          exit 0
+        fi
+
+        if [ "${{ steps.bun-download.outputs.is-musl }}" = "true" ]; then
+          echo "::error::Linux musl containers need Node.js 20 or newer and npm from musl-compatible packages. Install libstdc++, libgcc, nodejs, and npm before supabase/setup-cli, or run this job container as root so the action can install them."
+          exit 1
+        fi
+
+        if [ -n "${node_version}" ] || [ "${has_npm}" = "true" ]; then
+          echo "::error::Supabase CLI npm installs need both Node.js 20+ and npm. Found Node.js '${node_version:-missing}' and npm '${has_npm}'. Configure both before supabase/setup-cli."
+          exit 1
+        fi
+
+        echo "setup-node=true" >> "$GITHUB_OUTPUT"
+
+    - name: Setup Node
+      if: ${{ steps.node-runtime.outputs.setup-node == 'true' }}
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      with:
+        node-version: 24
+
     - name: Setup Bun
       uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       with:
@@ -112,5 +154,4 @@ runs:
       working-directory: ${{ github.action_path }}
       env:
         INPUT_VERSION: ${{ inputs.version }}
-        SUPABASE_CLI_GITHUB_TOKEN: ${{ inputs.github-token }}
       run: bun src/main.ts