feat(cli): add --skip-vault flag to db push#5780
Conversation
Previously, `supabase db push` always upserted `[db.vault]` secrets from config.toml into the target database before applying pending migrations. There was no way to push schema changes without also overwriting remote vault values with local/dev secrets. `db push` now accepts `--skip-vault`. Without the flag, behavior is unchanged: resolved vault secrets are still upserted before migrations run. With `--skip-vault`, vault updates are skipped and migrations still apply.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c683c8439d
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| if !skipVault { | ||
| if err := vault.UpsertVaultSecrets(ctx, utils.Config.Db.Vault, conn); err != nil { | ||
| return err | ||
| } | ||
| } else if len(vault.ResolvedSecretNames(utils.Config.Db.Vault)) > 0 { |
There was a problem hiding this comment.
When a project has encrypted [db.vault] values and the DOTENV_PRIVATE_KEY is not available, supabase db push --skip-vault still fails before reaching this branch: the root pre-run calls ParseDatabaseConfig and LoadConfig before Run, and config loading decrypts every config.Secret, returning the missing-key error before vault upserts can be skipped. This leaves the new flag unable to support the case where the user wants to apply migrations without having or using the local vault secret material.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
I believe this should be ok otherwise we'll have to plumb this flag into the config loading path, outside the scope of just db push.
Open to discussion / thoughts.
1 participant
What is the current behavior?
Previously,
supabase db pushalways upserted[db.vault]secrets from config.toml into the target database before applying pending migrations. There was no way to push schema changes without also overwriting remote vault values with local/dev secrets.What is the new behavior?
db pushnow accepts a new flag called--skip-vault.--skip-vault, vault updates are skipped and migrations still apply.Usage:
Ref
Closes #3815