From 3562be5623bd465096c05c988417eaf09c29b683 Mon Sep 17 00:00:00 2001
From: Julien Goux <hi@jgoux.dev>
Date: Mon, 29 Jun 2026 17:08:29 +0200
Subject: [PATCH] ci(cli): sync releases to Linear

---
 .github/workflows/release-shared.yml | 29 ++++++++++++++++++++++++++++
 .github/workflows/release.yml        |  2 ++
 2 files changed, 31 insertions(+)

diff --git a/.github/workflows/release-shared.yml b/.github/workflows/release-shared.yml
index 79d6ba7387..6bf2dc0248 100644
--- a/.github/workflows/release-shared.yml
+++ b/.github/workflows/release-shared.yml
@@ -55,6 +55,10 @@ on:
         required: false
       DF_FIREWALL_TOKEN:
         required: false
+      LINEAR_CLI_STABLE_RELEASE_ACCESS_KEY:
+        required: false
+      LINEAR_CLI_BETA_RELEASE_ACCESS_KEY:
+        required: false
 jobs:
   build-blacksmith:
     name: Build CLI artifacts (Blacksmith)
@@ -280,6 +284,8 @@ jobs:
       CHANNEL: ${{ inputs.channel }}
       NPM_TAG: ${{ inputs.npm_tag }}
       VERSION: ${{ inputs.version }}
+      LINEAR_CLI_STABLE_RELEASE_ACCESS_KEY: ${{ secrets.LINEAR_CLI_STABLE_RELEASE_ACCESS_KEY }}
+      LINEAR_CLI_BETA_RELEASE_ACCESS_KEY: ${{ secrets.LINEAR_CLI_BETA_RELEASE_ACCESS_KEY }}
     permissions:
       contents: write
       id-token: write
@@ -297,6 +303,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: true
+          fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
 
       - name: Setup
@@ -417,6 +424,28 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: gh release edit "v${VERSION}" --draft=false
 
+      - name: Sync stable release to Linear
+        if: ${{ inputs.channel == 'stable' && env.LINEAR_CLI_STABLE_RELEASE_ACCESS_KEY != '' }}
+        uses: linear/linear-release-action@c0cb8354a362c24c6d3e0948f37fd66d07588e3f # v0
+        with:
+          access_key: ${{ env.LINEAR_CLI_STABLE_RELEASE_ACCESS_KEY }}
+          version: v${{ inputs.version }}
+          name: Supabase CLI v${{ inputs.version }}
+          links: |
+            GitHub Release=https://github.com/${{ github.repository }}/releases/tag/v${{ inputs.version }}
+            Release workflow=https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
+
+      - name: Sync beta release to Linear
+        if: ${{ inputs.channel == 'beta' && env.LINEAR_CLI_BETA_RELEASE_ACCESS_KEY != '' }}
+        uses: linear/linear-release-action@c0cb8354a362c24c6d3e0948f37fd66d07588e3f # v0
+        with:
+          access_key: ${{ env.LINEAR_CLI_BETA_RELEASE_ACCESS_KEY }}
+          version: v${{ inputs.version }}
+          name: Supabase CLI v${{ inputs.version }}
+          links: |
+            GitHub Release=https://github.com/${{ github.repository }}/releases/tag/v${{ inputs.version }}
+            Release workflow=https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
+
   # Changelog backfill only needs tag + published GH release (from publish).
   # Runs in parallel with brew/scoop/smoke; must not gate distribution.
   backfill-release-notes:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 276c8c5add..ccfd511d6a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -225,6 +225,8 @@ jobs:
       GH_APP_PRIVATE_KEY: ${{ secrets.GH_APP_PRIVATE_KEY }}
       ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
       DF_FIREWALL_TOKEN: ${{ secrets.DF_FIREWALL_TOKEN }}
+      LINEAR_CLI_STABLE_RELEASE_ACCESS_KEY: ${{ secrets.LINEAR_CLI_STABLE_RELEASE_ACCESS_KEY }}
+      LINEAR_CLI_BETA_RELEASE_ACCESS_KEY: ${{ secrets.LINEAR_CLI_BETA_RELEASE_ACCESS_KEY }}
 
   # Posts to the release Slack channel once the pipeline succeeds. Listing
   # `release` in `needs` without a status function in `if:` keeps the implicit