Upstream Fork Tracking

Supabase upstream fork tracking

This repository uses a selective Supabase Studio strategy: track the upstream Supabase monorepo and copy only reviewed Studio-related paths that are needed locally. Do not vendor the full Supabase source tree into this repository.

Source of truth#

• Metadata: docs/supabase/upstream-tracking.json
• Offline verifier: pnpm verify:supabase-upstream
• Optional remote drift check: pnpm verify:supabase-upstream -- --check-remote

The metadata records the public upstream URL, explicit upstream ref, last verified commit, tracked local paths, and license handling notes. The checked-in commit is the ref operators should use when comparing or syncing selected components.

Current upstream baseline#

The local Studio surface currently tracked for selective sync is:

• apps/studio from upstream apps/studio
• packages/studio-ui from upstream packages/ui
• packages/studio-common from upstream packages/common
• packages/studio-config from upstream packages/config
• packages/studio-shared-data from upstream packages/shared-data
• packages/studio-pg-meta from upstream packages/pg-meta
• packages/studio-ai-commands from upstream packages/ai-commands
• packages/studio-api-types from upstream packages/api-types
• packages/studio-icons from upstream packages/icons
• packages/studio-tsconfig from upstream packages/tsconfig

Operator sync workflow#

Use a temporary sparse checkout outside this repository. This avoids destructive remote operations and avoids copying unrelated Supabase sources.

1
# 1. Verify this repo's tracking metadata first.
2
pnpm verify:supabase-upstream
3
4
# 2. Inspect remote drift without GitHub auth. This intentionally uses public git ls-remote.
5
pnpm verify:supabase-upstream -- --check-remote
6
7
# 3. Create a temporary sparse checkout at the recorded commit.
8
tmpdir="$(mktemp -d)"
9
git clone --filter=blob:none --sparse https://github.com/supabase/supabase.git "$tmpdir/supabase"
10
cd "$tmpdir/supabase"
11
git sparse-checkout set \
12
  apps/studio \
13
  packages/ui \
14
  packages/common \
15
  packages/config \
16
  packages/shared-data \
17
  packages/pg-meta \
18
  packages/ai-commands \
19
  packages/api-types \
20
  packages/icons \
21
  packages/tsconfig
22
git checkout 432b339ff9a7c7e30252272e36eea985ad589b5b

Then compare or copy only the reviewed file or directory you need. Examples:

1
# Compare a candidate file before copying.
2
git -C "$tmpdir/supabase" diff --no-index -- \
3
  packages/ui/src/components/button.tsx \
4
  /path/to/assistance/packages/studio-ui/src/components/button.tsx
5
6
# Copy a deliberately selected path, not the whole upstream tree.
7
rsync -a --delete \
8
  "$tmpdir/supabase/packages/ui/src/components/button/" \
9
  /path/to/assistance/packages/studio-ui/src/components/button/

After copying:

1. Preserve upstream copyright and license notices.
2. Update docs/supabase/upstream-tracking.json if the synced commit changes.
3. Run pnpm verify:supabase-upstream.
4. Run the narrow app/package checks relevant to the copied path.
5. Commit the metadata update and code changes together so provenance stays attached to the change.

Final verification evidence — 2026-06-23#

This final pass verified the merged fork-tracking and Studio component-reuse slices without claiming a broad repository green state.

• Upstream metadata/offline script:

  bash

  1
  mise run verify:supabase-upstream

  Passed: verify-supabase-upstream-tracking: PASS; checked 18 assertions.

• Remote drift signal:

  bash

  1
  mise exec -- pnpm verify:supabase-upstream -- --check-remote

  Failed as expected because refs/heads/master advanced from 432b339ff9a7c7e30252272e36eea985ad589b5b to acd9ddabc516a1851a0c751223879ac86620edc6; keep the checked-in baseline until that delta is reviewed.

• Shared Studio UI export surface:

  bash

  1
  mise exec -- pnpm --filter studio-ui typecheck

  Passed.

• Studio files touched by component reuse:

  bash

  1
  mise exec -- pnpm --filter studio exec eslint \
  2
    components/interfaces/APIKeys/ApiKeyPill.tsx \
  3
    components/interfaces/DiskManagement/fields/AutoScaleFields.tsx \
  4
    components/interfaces/DiskManagement/fields/IOPSField.tsx \
  5
    components/interfaces/DiskManagement/fields/ThroughputField.tsx \
  6
    components/interfaces/Integrations/Wrappers/InputField.tsx \
  7
    components/interfaces/SQLEditor/DownloadSnippetModal.tsx \
  8
    components/to-be-cleaned/forms/AutoTextArea.tsx \
  9
    ../../packages/studio-ui/index.tsx

  Passed with existing warnings only: no-explicit-any in InputField.tsx, no-restricted-exports default-export warnings, and the package index ignored outside the Studio ESLint base path.

• Studio production build:

  bash

  1
  SKIP_ASSET_UPLOAD=1 mise run build:studio

  Passed: Next.js compiled successfully, collected page data, and generated 182 static pages; static asset upload intentionally skipped for local verification.

• Studio type generation/typecheck attempt:

  bash

  1
  mise run typecheck:studio

  next typegen passed; the tsc --noEmit phase produced no diagnostics before the local 900-second timeout, so this pass does not claim full Studio typecheck green.

Remaining follow-up tasks:

1. Review Supabase upstream changes between 432b339ff9a7c7e30252272e36eea985ad589b5b and acd9ddabc516a1851a0c751223879ac86620edc6 before advancing docs/supabase/upstream-tracking.json.
2. Re-run full mise run typecheck:studio in a longer-lived CI or optimized local environment if a full Studio typecheck gate is required; this pass used studio-ui typecheck, targeted Studio ESLint, and the Studio production build as the bounded verification evidence.
3. If future reuse work moves more files from local shims to studio-ui, keep using targeted app/package checks and update this evidence section with the exact commands instead of implying whole-repo coverage.

Fork guidance#

If we create an Assistance-owned fork, configure it outside this repo and keep this repo pointed at the public upstream unless a specific sync requires the fork:

1
git -C "$tmpdir/supabase" remote add assistance-fork <public-fork-url>
2
git -C "$tmpdir/supabase" fetch assistance-fork

Do not require GitHub auth for the default verification path. Do not push, delete branches, rewrite history, or change remotes from repo automation. Any fork-specific branch should be created and pushed manually by an operator after reviewing the selected component delta.

License constraints#

• Supabase monorepo root license: Apache-2.0.
• Package metadata for packages/ui, packages/common, packages/config, packages/shared-data, packages/pg-meta, packages/ai-commands, and packages/api-types declares MIT at the recorded upstream baseline.
• Package metadata for apps/studio, packages/icons, and packages/tsconfig does not declare a package-level license at the recorded baseline; treat the repository root Apache-2.0 license as the baseline and review assets separately before broad import.
• Keep local package namespacing (studio-*) unless a deliberate code change updates imports and workspace boundaries.