chore(dev/onboarding): set up mise-based workflow for initial codebase setup

.bun-version

@@ -0,0 +1 @@
+1.3.13

.github/actions/setup/action.yml

@@ -9,56 +9,78 @@ inputs:
     default: ""
   dependency-cache:
     description: >-
-      Whether to enable the pnpm dependency cache. Disable this when the job
-      deletes the pnpm store before exiting, otherwise the post-job cache save
+      Whether to enable dependency caches. Disable this when the job deletes a
+      cached dependency path before exiting, otherwise the post-job cache save
       fails with a path validation error.
     required: false
     default: "true"
 
 runs:
   using: "composite"
   steps:
-    - name: Resolve Bun version
+    - name: Resolve mise cache key
+      id: mise-cache-key
       shell: bash
-      run: echo "BUN_VERSION=1.3.13" >> "$GITHUB_ENV"
+      run: |
+        node <<'JS' >> "$GITHUB_OUTPUT"
+        const { createHash } = require("node:crypto");
+        const { readFileSync } = require("node:fs");
 
-    - name: Install Bun
-      id: install-bun
-      uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
-      continue-on-error: true
-      with:
-        bun-version: ${{ env.BUN_VERSION }}
+        const packageJson = JSON.parse(readFileSync("package.json", "utf8"));
+        const payload = {
+          bun: readFileSync(".bun-version", "utf8").trim(),
+          mise: readFileSync("mise.toml", "utf8").trim(),
+          node: packageJson.devEngines?.runtime,
+          pnpm: packageJson.packageManager,
+        };
+        const digest = createHash("sha256")
+          .update(JSON.stringify(payload))
+          .digest("hex");
+        console.log(`hash=${digest}`);
+        JS
 
-    - name: Install Bun (fallback with retries)
-      if: steps.install-bun.outcome == 'failure'
-      uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
+    - name: Install toolchains
+      uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4
       with:
-        timeout_minutes: 3
-        max_attempts: 5
-        retry_wait_seconds: 30
-        command: |
-          curl -fsSL https://bun.sh/install | bash -s "bun-v${BUN_VERSION}"
-          echo "$HOME/.bun/bin" >> "$GITHUB_PATH"
+        version: 2026.7.0
+        install: true
+        cache_key: >-
+          {{cache_key_prefix}}-{{platform}}-{{version}}-${{
+          steps.mise-cache-key.outputs.hash }}
 
-    - name: Verify Bun
+    - name: Resolve pnpm store path
+      if: inputs.dependency-cache == 'true'
+      id: pnpm-store
       shell: bash
-      run: bun --version
+      run: echo "path=$(pnpm store path --silent)" >> "$GITHUB_OUTPUT"
 
-    - name: Install Node.js
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+    - name: Configure pnpm dependency cache
+      if: inputs.dependency-cache == 'true'
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
-          node-version-file: .nvmrc
-          package-manager-cache: false
+        path: ${{ steps.pnpm-store.outputs.path }}
+        key: pnpm-store-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('pnpm-lock.yaml') }}
+        restore-keys: |
+          pnpm-store-${{ runner.os }}-${{ runner.arch }}-
 
-    - name: Enable Corepack
+    - name: Resolve Go cache paths
+      if: inputs.dependency-cache == 'true'
+      id: go-cache
       shell: bash
-      run: npm install --global --force corepack && corepack enable
+      run: |
+        echo "mod=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
+        echo "build=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
 
-    - name: Configure dependency cache
+    - name: Configure Go dependency cache
       if: inputs.dependency-cache == 'true'
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
-        cache: pnpm
+        path: |
+          ${{ steps.go-cache.outputs.mod }}
+          ${{ steps.go-cache.outputs.build }}
+        key: go-cache-${{ runner.os }}-${{ runner.arch }}-${{ hashFiles('apps/cli-go/go.mod', 'apps/cli-go/go.sum') }}
+        restore-keys: |
+          go-cache-${{ runner.os }}-${{ runner.arch }}-
 
     - name: Install dependencies
       shell: bash

.github/workflows/build-cli-artifacts.yml

@@ -76,13 +76,6 @@ jobs:
         with:
           dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
 
-      - name: Setup Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
-        with:
-          go-version-file: apps/cli-go/go.mod
-          cache: true
-          cache-dependency-path: apps/cli-go/go.sum
-
       - name: Pre-download Go modules
         working-directory: apps/cli-go
         run: go mod download -x

.github/workflows/cli-go-ci.yml

@@ -78,16 +78,18 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4
         with:
-          go-version-file: apps/cli-go/go.mod
-          # Linter requires no cache
-          cache: false
+          version: 2026.7.0
+          install: true
+          install_args: >-
+            go
+            go:github.com/golangci/golangci-lint/v2/cmd/golangci-lint
 
       - uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1
         with:
           args: --timeout 5m --verbose
-          version: latest
+          install-mode: none
           only-new-issues: true
           working-directory: apps/cli-go
 

.github/workflows/live-e2e.yml

@@ -113,12 +113,6 @@ jobs:
       - name: Setup
         uses: ./.github/actions/setup
 
-      - name: Setup Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
-        with:
-          go-version-file: apps/cli-go/go.mod
-          cache-dependency-path: apps/cli-go/go.sum
-
       # Build the Go binary for every target: `go` runs it directly and
       # `ts-legacy` shells out to it for most commands.
       - name: Build Go CLI

.github/workflows/test.yml

@@ -43,14 +43,6 @@ jobs:
         uses: ./.github/actions/setup
         with:
           dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
-      - name: Setup Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
-        with:
-          go-version-file: apps/cli-go/go.mod
-          cache-dependency-path: apps/cli-go/go.sum
-      - name: Install golangci-lint
-        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest &&
-          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
       - name: Unlock keyring (for cli-go keyring tests)
         uses: t1m0thyj/unlock-keyring@cbcf205c879ebd86add70bab3a6abfcce59a5cae # v1.2.0
 
@@ -74,14 +66,6 @@ jobs:
         uses: ./.github/actions/setup
         with:
           dependency-firewall-token: ${{ secrets.DF_FIREWALL_TOKEN }}
-      - name: Setup Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
-        with:
-          go-version-file: apps/cli-go/go.mod
-          cache-dependency-path: apps/cli-go/go.sum
-      - name: Install golangci-lint
-        run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@latest &&
-          echo "$(go env GOPATH)/bin" >> "$GITHUB_PATH"
       - name: Unlock keyring (for cli-go keyring tests)
         uses: t1m0thyj/unlock-keyring@cbcf205c879ebd86add70bab3a6abfcce59a5cae # v1.2.0
 
@@ -144,14 +128,6 @@ jobs:
           key: go-cli-${{ runner.os }}-${{ hashFiles('apps/cli-go/**/*.go',
             'apps/cli-go/go.mod', 'apps/cli-go/go.sum') }}
 
-      - name: Setup Go
-        if: steps.detect.outputs.cli_e2e == 'true' &&
-          steps.cache-go-binary.outputs.cache-hit != 'true'
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
-        with:
-          go-version-file: apps/cli-go/go.mod
-          cache-dependency-path: apps/cli-go/go.sum
-
       - name: Build Go CLI
         if: steps.detect.outputs.cli_e2e == 'true' &&
           steps.cache-go-binary.outputs.cache-hit != 'true'

CONTRIBUTING.md

@@ -4,6 +4,60 @@ Bun monorepo for exploring the next generation of the Supabase CLI and local dev
 
 ## Setup
 
+### Tool versions
+
+This repo pins the versions of Node, Bun, Go, pnpm, and golangci-lint that contributors are expected to build against, and uses [`mise`](https://mise.jdx.dev/) — a polyglot version manager — to install and activate Node, Bun, Go, pnpm, and golangci-lint automatically. If you don't already have these tools installed, `mise` is a great way to get up and running quickly.
+
+#### Installing mise
+
+```sh
+# macOS / Linux
+curl https://mise.run | sh
+
+# macOS via Homebrew
+brew install mise
+```
+
+See the [`mise` installation docs](https://mise.jdx.dev/getting-started.html) for other package managers (apt, dnf, cargo, npm, Windows, …).
+
+`mise` needs to hook into your shell so it can inject the right tool versions into your `PATH` as you move between directories. Follow the `mise activate` instructions [in this section](https://mise.jdx.dev/getting-started.html#activate-mise) to add the activation line for your shell to its startup file.
+
+This repo relies on `mise` support for reading Node and pnpm versions from `package.json`, so use mise `2026.7.0` or newer.
+
+#### Installing the pinned tool versions
+
+Trust this repo's `mise.toml` once from the repo root so `mise` can read the project setting that enables idiomatic version files:
+
+```sh
+mise trust
+```
+
+Then install the pinned tool versions:
+
+```sh
+mise install
+```
+
+After `mise trust`, `mise` resolves the versions this repo expects from a handful of files, rather than hardcoding them all in one place:
+
+| Tool | Version source |
+| --- | --- |
+| Bun | `.bun-version` |
+| Node.js | `devEngines.runtime` field in `package.json` |
+| pnpm | `packageManager` field in `package.json` |
+| Go | `mise.toml` |
+| golangci-lint | `mise.toml` |
+
+The Go and golangci-lint entries in `mise.toml` are intentionally temporary while the Go CLI remains in the repo. The canonical Go module metadata still lives in `apps/cli-go/go.mod`; keep the `mise.toml` entries aligned only until the Go code is removed.
+
+Once installed, `mise` activates these versions automatically whenever your shell is inside this repo — no manual `nvm use`, `gvm use`, or similar switching required.
+
+#### Without mise
+
+`mise` is not required. If you already have Bun, Node, pnpm, and Go installed and managed some other way, just make sure your versions match the ones pinned in `.bun-version`, `mise.toml`, `package.json`, and `apps/cli-go/go.mod`.
+
+### Install dependencies
+
 Install workspace dependencies:
 
 ```sh

apps/cli-go/go.mod

@@ -1,6 +1,6 @@
 module github.com/supabase/cli
 
-go 1.25.5
+go 1.25.11
 
 require (
 	github.com/BurntSushi/toml v1.6.0

mise.toml

@@ -0,0 +1,6 @@
+[tools]
+go = "1.25.11"
+"go:github.com/golangci/golangci-lint/v2/cmd/golangci-lint" = "2.1.6"
+
+[settings]
+idiomatic_version_file_enable_tools = ["node", "bun", "pnpm"]

package.json

@@ -1,6 +1,12 @@
 {
   "name": "@supabase/root",
   "private": true,
+  "devEngines": {
+    "runtime": {
+      "name": "node",
+      "version": "24"
+    }
+  },
   "scripts": {
     "test:core": "nx run-many -t test:unit test:integration --coverage.enabled",
     "test:e2e": "nx run-many -t test:e2e",