Conversation
Slim images are published to ghcr.io/supabase/cli/<service> only, so the CLI cannot pull them through public.ecr.aws like its other images, and mirror drift keeps surfacing as manifest-not-found failures in dependent CI. Reuse the mirror machinery and AWS credentials that already live in supabase/cli instead of provisioning AWS access for this repository. - scripts/ecr-mirror.sh sends a mirror-slim-image repository_dispatch to supabase/cli and polls public.ecr.aws/supabase/cli/<service>:<version> anonymously until its index digest matches the published GHCR digest. Its sync mode audits every published release and can re-request out-of-sync tags, which doubles as the backfill path. - service-release.yml gains a mirror-ecr job between publish-image and publish-release. It skips with a notice until the CLI_MIRROR_DISPATCH_TOKEN secret exists; once configured, an unverified mirror fails the release, and verified releases list the ECR references in their notes. - ecr-mirror-check.yml runs the sync audit daily. - docs/design/ecr-mirror-dispatch.md records the dispatch contract the supabase/cli handler must implement (digest-preserving copy, payload validation, repository creation) and the setup checklist. - scripts/test-ecr-mirror.sh covers the payload contract, input validation, and the token guard, and is wired into repository checks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YaJgsq9xTCpMnEhqesr87S
jgoux
approved these changes
Sep 1, 2026
list_releases dropped tags that fail today's tag_pattern (live postgres-15 releases), dest digest inherited ambient registry creds, and the daily check skipped entirely without the write token. Audit by service prefix, isolate dest lookups, and always run compare-only sync. Co-authored-by: Cursor <cursoragent@cursor.com>
Overwrite GHCR tags and GitHub assets on republish, always dispatch ECR, and publish natives as :version-native-<target>.
Replace the inline Python/shell mirror and publish helpers with bun scripts so the same paths can be tested and replayed outside CI.
Publish native OCI artifacts and force same-version ECR mirrors
Two cross-review findings on the sync path: - syncReleases failed on the first published GitHub Release with no GHCR image (postgres 15.8.1.085 predates image publication), so the audit and backfill never reached the remaining ~230 tags. Such releases are now logged, counted, and skipped. - --request waited up to ECR_MIRROR_TIMEOUT per release for the native tags to land, but the live supabase/cli handler copies images only. 232 serial waits cannot finish inside the job timeout. Native drift is now reported without failing the audit or blocking the backfill; ECR_MIRROR_REQUIRE_NATIVES=1 restores the strict behaviour once the handler copies natives. Image drift still fails the audit, and the release-time mirror-ecr job is unchanged. Tests cover the skip, the non-blocking default, and the required-natives mode. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01YaJgsq9xTCpMnEhqesr87S
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Mirror slim images (and their native OCI artifacts) from GHCR to AWS ECR Public by reusing the mirror workflow and AWS credentials that already live in
supabase/cli. This repository sends arepository_dispatchevent after each release and verifies, with anonymous pulls, that the ECR destination serves the same digest as GHCR. No AWS access is added here.This PR also carries #308 (merged into this branch), which moved the tooling to TypeScript and added native artifact publication. Design and the dispatch contract:
docs/design/ecr-mirror-dispatch.md. CLI-side consumption is recorded insupabase/cliADR 0026.What changes
scripts/ecr-mirror.ts(bun) withpayload,published-digest,destination-repo,request,verify, andsyncsubcommands.requestdispatchesmirror-slim-imagetosupabase/cliand pollspublic.ecr.aws/supabase/cli/<service>:<version>anonymously until its index digest matches.syncaudits every published release and, with--request, re-dispatches out-of-sync images (this is also the backfill path).scripts/publish-native-oci.tspushes each release's native triplet (tar.zst,manifest.json, checksum) to GHCR as OCI artifacts under<version>-native-<target>tags; the dispatch payload carries them asnatives: [{tag, digest}]for the cli handler to copy best-effort.service-release.yml: newpublish-natives(best-effort,continue-on-error) andmirror-ecrjobs.publish-releasedepends onmirror-ecr. Until theCLI_MIRROR_DISPATCH_TOKENsecret exists,mirror-ecrskips with a notice and releases behave exactly as today; once set, an unverified image mirror fails the release and verified releases list the ECR references in their notes.ecr-mirror-check.yml: daily compare-only audit; manualrequest: truebackfills.--requeston a handler that copies images only.ECR_MIRROR_REQUIRE_NATIVES=1restores strict native checks oncesupabase/clicopies natives ondevelop.scripts/ecr-mirror.test.tsandscripts/publish-native-oci.test.ts(bun), wired intorepository-checks.yml;scripts/test-external-workflows.shguards the workflow wiring.Naming
Destination is
public.ecr.aws/supabase/cli/<service>(same path as GHCR, only the registry host changes). Slim tags reuse upstream version strings, so they cannot share the upstream mirror repos atpublic.ecr.aws/supabase/<service>.Test plan
bun test ./scripts/ecr-mirror.test.ts ./scripts/publish-native-oci.test.ts(21 tests) andbun build --no-bundlerun inrepository checks.scripts/test-external-workflows.shexecutes the release-notes block and asserts the job wiring.Rollout (outside this PR)
mirror-slim-imagehandler insupabase/cli(image copy is ondevelop; native copy is in ci(repo): mirror slim images and native OCI artifacts to ECR Public cli#6661).cli/<service>ECR Public repositories or grant the handler's roleecr-public:CreateRepository.CLI_MIRROR_DISPATCH_TOKENhere. Leave it unset until the cli handler is ready; the daily audit is compare-only without it.ECR mirror checkwithrequest: true, in service-sized slices rather than one shot: each image verify can take up to 15 minutes and there are ~232 published releases.This PR is safe to merge before any of the above: every new path is inert until the secret exists.
🤖 Generated with Claude Code
https://claude.ai/code/session_01YaJgsq9xTCpMnEhqesr87S