Configure Supabase CI/CD integration with GitHub Actions and testing.
Use when setting up automated testing, configuring CI pipelines,
or integrating Supabase tests into your build process.
Trigger with phrases like "supabase CI", "supabase GitHub Actions",
"supabase automated tests", "CI supabase".
Build GitHub Actions workflows that automate the full Supabase lifecycle: link projects in CI, push migrations on merge, deploy Edge Functions, generate TypeScript types, run tests against a local Supabase instance, and create preview branches for pull requests. Every database change gets validated before it reaches production.
The pull-request CI pipeline runs these stages, all detailed in ci-workflows.md:
Start a local Supabase instance (unused services disabled for speed).
Apply every migration from scratch with npx supabase db reset.
Regenerate TypeScript types and fail the build on drift from the committed version.
Run pgTAP database tests and the application test suite against the local instance.
Store credentials as GitHub repository secrets. The CI pipeline uses these to authenticate with your Supabase project without exposing tokens in code.
# Set secrets via GitHub CLI
gh secret set SUPABASE_ACCESS_TOKEN --body "<your-access-token>"
gh secret set SUPABASE_DB_PASSWORD --body "<your-database-password>"
gh secret set SUPABASE_PROJECT_REF --body "<your-project-ref>"
Step 2: CI Workflow — Test, Validate Migrations, and Generate Types
Add .github/workflows/supabase-ci.yml that runs on every pull request. It starts a local Supabase instance, runs db reset to apply all migrations from scratch, regenerates types and fails on drift (git diff --exit-code), then runs pgTAP and application tests. The default local dev keys are safe to commit — they only work against the local instance. Copy the complete workflow from ci-workflows.md.
Step 3: Deploy Migrations and Edge Functions on Merge
Add .github/workflows/supabase-deploy.yml, scoped with paths: to supabase/migrations/** and supabase/functions/** so it only runs when database or function code changes on main. It links the remote project, runs npx supabase db push, deploys Edge Functions, and regenerates types from the production schema. Full workflow in ci-workflows.md.
Preview Branches
Create isolated Supabase environments per pull request with npx supabase branches create, so reviewers test against real infrastructure with migrations applied. Preview branches require a Supabase Pro plan and incur compute costs while running. Workflow snippet in ci-workflows.md.
Testing in CI
Two test layers run inside the CI workflow:
pgTAP database tests in supabase/tests/ validate that RLS is enabled on public tables and that policies behave correctly. Run locally with npx supabase test db.
Application tests use createClient from @supabase/supabase-js pointed at http://127.0.0.1:54321 with the local anon key.
Both patterns — the pgTAP SQL and the TypeScript client setup — are in testing-patterns.md.
Output
After implementing these workflows:
Pull requests run tests against a fresh local Supabase instance with all migrations applied
TypeScript type drift is detected automatically — stale types block the PR
Database migrations deploy to production only on merge to main
Edge Functions deploy alongside migration changes
pgTAP tests validate RLS policies and schema constraints in CI
Preview branches provide isolated environments for PR review (Pro plan)
GitHub secrets keep SUPABASE_ACCESS_TOKEN and SUPABASE_DB_PASSWORD out of code
Error Handling
Error
Cause
Solution
supabase start fails in CI
Docker not available
Use ubuntu-latest runner (includes Docker by default)
supabase db push returns "permission denied"
Invalid or expired access token
Regenerate token at supabase.com/dashboard/account/tokens
supabase link fails
Wrong project ref
Check project ref in Settings > General, must match SUPABASE_PROJECT_REF secret
Type drift detected in PR
Schema changed without regenerating types
Run npx supabase gen types typescript --local > src/types/database.types.ts
supabase functions deploy fails
Missing Deno types or syntax errors
Run npx supabase functions serve locally first to catch issues
pgTAP tests fail
Missing RLS policies or schema constraints
Add policies before merging — npx supabase test db runs locally
Preview branch creation fails
Free plan limitation
Preview branches require Supabase Pro plan
Migration conflict on push
Divergent migration history
Run npx supabase db pull to reconcile remote vs local migrations
Examples
Minimal CI for a new project — just migration validation and type checking:
For deploying Supabase-backed applications to hosting platforms, see supabase-deploy-integration. For configuring RLS policies, see supabase-rls-policies.
