The policy accepted only `staging` as a head for main, so any change
production needed before the next promotion had nowhere to go: the PR was
unmergeable by CI and branch protection blocks direct pushes.
Accept `hotfix/*` and `release/*` heads as well. The naming requirement
keeps a direct-to-main change deliberate and visible, and the master
freeze plus the "features target staging" rule are unchanged. Document
the escape hatch and the need to land the same commit on staging.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Measure untouched mobile source, add regression coverage for native media paths and account operations, and enforce ratcheting API and mobile thresholds in required CI checks.
Add concise routed context, task-aware agent roles, focused skills, and structured learning promotion.\n\nUnify local development and workspace tooling, add layered test and E2E verification, harden MCP authentication, and gate deployment behind verification and explicit production promotion.
All 57 pre-existing migrations have been registered in prod's
schema_migrations table so db push --include-all will skip them
and only apply new migrations.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Production only had one migration tracked in schema_migrations.
With --include-all, db push tried to re-run all 57 earlier migrations.
Without it, only migrations newer than the latest tracked version are applied.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Allows migrations with timestamps before existing remote migrations
to be applied. Needed when migration files are renamed or when
environments have diverged.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Use matrix strategy to deploy sequentially: non-prod first, then prod.
This ensures both environments stay in sync and provides a safety gate.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Use grep to only match lines starting with lowercase (function names),
and add validation to skip empty or invalid names.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
CLI expects supabase/functions/ relative to workdir, so --workdir apps
makes it find apps/supabase/functions/.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
supabase db push doesn't support --project-ref, it relies on link.
Run link from apps/supabase so the config is in the right place.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Allow manual triggering via workflow_dispatch
- Trigger on changes to the workflow file itself
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The supabase link command was running from repo root while db push
ran from apps/supabase, causing it to not find the linked project.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
jjbruntonandClaude Opus 5