Supabase CLI module

[github-actions[bot]]

A discussion dedicated to the Supabase CLI module. Share your thoughts, questions, and feedback here.

Module Scorecard

Presentation & Onboarding	Credential Hygiene	Restricted-Environment Readiness	Engineering Quality	Overall
12 / 17	20 / 20	20 / 20	10 / 10	93 / 100

Drilldown

Presentation & Onboarding — 12 / 17

Criterion	Max	Score	Notes
Configuration-mode examples	12	12	README provides documented examples for all major modes: personal access token, external auth (OAuth), project dashboard link, custom install method, pre-installed binary (air-gapped), and internal mirror. Each has sensible defaults and clear context.
Visual preview	5	0	No image, GIF, or video in README. Icon reference does not count.

Credential Hygiene — 20 / 20

Criterion	Max	Score	Notes
Secrets marked sensitive	16	16	access_token and db_password variables are marked sensitive = true in main.tf. README examples use var.supabase_token references and include a NOTE admonishing "Never hardcode tokens in your template." No inline literal secrets in examples.
Non-hardcoded auth path	4	4	README documents Coder external auth (OAuth) as the primary authentication method with full setup instructions, avoiding raw key pasting. Personal access token is offered as an alternative but OAuth is prominently featured.

Restricted-Environment Readiness — 20 / 20

Criterion	Max	Score	Notes
Mirrorable artifact source	5	5	download_base_url variable (default https://github.com/supabase/cli/releases/download) overrides the CLI download URL. README includes "With Internal Mirror" example showing download_base_url = "https://artifacts.internal.corp/supabase-cli/releases/download".
Bring-your-own binary	10	10	skip_install = true variable documented in "Pre-installed Binary (Air-gapped / Golden Image)" example. When enabled, install is skipped entirely while auth configuration still runs. Clearly documented.
Egress transparency	3	3	Dedicated "Network Egress" README section enumerates external endpoints: api.github.com, github.com, api.supabase.com, supabase.com, and Homebrew/Scoop repos. Includes purpose and timing columns, plus note for restricted environments.
Runs without sudo	2	2	Install script (install.sh.tftpl) attempts sudo for package managers (dpkg, rpm, apk) but falls back to binary install when sudo fails or is absent. Binary install path never invokes sudo. Core functionality (binary install, auth setup) works without root.

Engineering Quality — 10 / 10

Criterion	Max	Score	Notes
Input quality	6	6	All variables have clear descriptions. Defaults are sensible (install_method = "detect", supabase_version = "latest"). install_method has validation block ensuring only valid values. Sensitive inputs properly marked.
Test coverage	4	4	.tftest.hcl covers 20+ business logic scenarios (install methods, auth modes, project linking, skip_install, custom URLs). main.test.ts has end-to-end tests verifying binary installation on Ubuntu/Debian, symlink creation, install method selection, and variable validation. Clear testing story.

Overall — 93 / 100

Raw 62 / 67 → round(62 / 67 × 100) = 93

Track: Utility (CLI helper tool, not an agent or IDE)

---

Scored against SCORECARD.md on 2026-09-21 with claude-sonnet-4-5.