Significant-Gravitas · ntindle · Jul 30, 2026 · Jun 10, 2026 · Jun 10, 2026 · Jun 10, 2026
@@ -132,11 +132,7 @@ jobs:
             "rabbitmq:management"
             "clamav/clamav-debian:latest"
             "busybox:latest"
-            "kong:2.8.1"
-            "supabase/gotrue:v2.170.0"
-            "supabase/postgres:15.8.1.049"
-            "supabase/postgres-meta:v0.86.1"
-            "supabase/studio:20250224-d10db0f"
+            "pgvector/pgvector:pg16"
           )
 
           # Check if any cached tar files exist (more reliable than cache-hit)

@@ -145,11 +145,7 @@ jobs:
             "rabbitmq:management"
             "clamav/clamav-debian:latest"
             "busybox:latest"
-            "kong:2.8.1"
-            "supabase/gotrue:v2.170.0"
-            "supabase/postgres:15.8.1.049"
-            "supabase/postgres-meta:v0.86.1"
-            "supabase/studio:20250224-d10db0f"
+            "pgvector/pgvector:pg16"
           )
 
           # Check if any cached tar files exist (more reliable than cache-hit)

@@ -152,11 +152,7 @@ jobs:
             "rabbitmq:management"
             "clamav/clamav-debian:latest"
             "busybox:latest"
-            "kong:2.8.1"
-            "supabase/gotrue:v2.170.0"
-            "supabase/postgres:15.8.1.049"
-            "supabase/postgres-meta:v0.86.1"
-            "supabase/studio:20250224-d10db0f"
+            "pgvector/pgvector:pg16"
           )
 
           # Check if any cached tar files exist (more reliable than cache-hit)

@@ -210,10 +210,9 @@ jobs:
           # picks the right published port per shard.
           #
           # Not reusing docker-compose.platform.yml directly because compose
-          # validates the full file even when only some services are ``up``,
-          # and that file references services (db/kong/...) defined in a
-          # sibling compose file — pulling both in would needlessly couple
-          # CI to the full local-dev stack.
+          # validates the full file even when only some services are ``up``
+          # — pulling it in would needlessly couple CI to the full
+          # local-dev stack.
           docker network create redis-cluster-ci
           for i in 0 1 2; do
             port=$((17000 + i))
@@ -260,11 +259,6 @@ jobs:
           docker exec redis-0 redis-cli -p 17000 cluster info >&2 || true
           exit 1
 
-      - name: Setup Supabase
-        uses: supabase/setup-cli@v1
-        with:
-          version: 1.178.1
-
       - id: get_date
         name: Get date
         run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
@@ -318,15 +312,28 @@ jobs:
       - name: Generate Prisma Client
         run: poetry run prisma generate && poetry run gen-prisma-stub
 
-      - id: supabase
-        name: Start Supabase
-        working-directory: .
+      - name: Start Postgres
+        working-directory: autogpt_platform
         run: |
-          supabase init
-          supabase start --exclude postgres-meta,realtime,storage-api,imgproxy,inbucket,studio,edge-runtime,logflare,vector,supavisor
-          supabase status -o env | sed 's/="/=/; s/"$//' >> $GITHUB_OUTPUT
-        # outputs:
-        # DB_URL, API_URL, GRAPHQL_URL, ANON_KEY, SERVICE_ROLE_KEY, JWT_SECRET
+          # Plain pgvector Postgres; the init script creates the legacy
+          # `auth` schema shim that historical migrations reference.
+          docker run -d --name postgres-test \
+            -e POSTGRES_USER=postgres \
+            -e POSTGRES_PASSWORD=postgres \
+            -e POSTGRES_DB=postgres \
+            -p 5432:5432 \
+            -v "$(pwd)/db/init/00-init.sql:/docker-entrypoint-initdb.d/00-init.sql:ro" \
+            pgvector/pgvector:pg16
+          for _ in $(seq 1 30); do
+            if docker exec postgres-test pg_isready -U postgres >/dev/null 2>&1; then
+              echo "Postgres ready"
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "Postgres failed to start" >&2
+          docker logs postgres-test >&2
+          exit 1
 
       - name: Wait for ClamAV to be ready
         run: |
@@ -360,8 +367,8 @@ jobs:
       - name: Run Database Migrations
         run: poetry run prisma migrate deploy
         env:
-          DATABASE_URL: ${{ steps.supabase.outputs.DB_URL }}
-          DIRECT_URL: ${{ steps.supabase.outputs.DB_URL }}
+          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
+          DIRECT_URL: postgresql://postgres:postgres@localhost:5432/postgres
 
       - name: Run pytest with coverage
         run: |
@@ -374,11 +381,9 @@ jobs:
           fi
         env:
           LOG_LEVEL: ${{ runner.debug && 'DEBUG' || 'INFO' }}
-          DATABASE_URL: ${{ steps.supabase.outputs.DB_URL }}
-          DIRECT_URL: ${{ steps.supabase.outputs.DB_URL }}
-          SUPABASE_URL: ${{ steps.supabase.outputs.API_URL }}
-          SUPABASE_SERVICE_ROLE_KEY: ${{ steps.supabase.outputs.SERVICE_ROLE_KEY }}
-          JWT_VERIFY_KEY: ${{ steps.supabase.outputs.JWT_SECRET }}
+          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/postgres
+          DIRECT_URL: postgresql://postgres:postgres@localhost:5432/postgres
+          JWT_VERIFY_KEY: "ci-only-jwt-verify-key-with-at-least-32-characters" # DO NOT USE IN PRODUCTION!!
           REDIS_HOST: "localhost"
           REDIS_PORT: "17000"
           ENCRYPTION_KEY: "dvziYgz0KSK8FENhju0ZYi8-fRTfAdlz6YLhdB_jhNw=" # DO NOT USE IN PRODUCTION!!

@@ -156,7 +156,7 @@ jobs:
         with:
           submodules: recursive
 
-      - name: Set up Platform - Copy default supabase .env
+      - name: Set up Platform - Copy default platform .env
         run: |
           cp ../.env.default ../.env
 
@@ -214,15 +214,13 @@ jobs:
         uses: actions/cache@v5
         with:
           path: /tmp/e2e_test_data.sql
-          key: e2e-test-data-${{ hashFiles('autogpt_platform/backend/test/e2e_test_data.py', 'autogpt_platform/backend/migrations/**', '.github/workflows/platform-fullstack-ci.yml') }}
+          key: e2e-test-data-${{ hashFiles('autogpt_platform/backend/test/e2e_test_data.py', 'autogpt_platform/backend/backend/data/user.py', 'autogpt_platform/backend/migrations/**', '.github/workflows/platform-fullstack-ci.yml') }}
 
-      - name: Set up Platform - Start Supabase DB + Auth
+      - name: Set up Platform - Start database
         run: |
-          docker compose -f ../docker-compose.resolved.yml up -d db auth --no-build
+          docker compose -f ../docker-compose.resolved.yml up -d db --no-build
           echo "Waiting for database to be ready..."
           timeout 60 sh -c 'until docker compose -f ../docker-compose.resolved.yml exec -T db pg_isready -U postgres 2>/dev/null; do sleep 2; done'
-          echo "Waiting for auth service to be ready..."
-          timeout 60 sh -c 'until docker compose -f ../docker-compose.resolved.yml exec -T db psql -U postgres -d postgres -c "SELECT 1 FROM auth.users LIMIT 1" 2>/dev/null; do sleep 2; done' || echo "Auth schema check timeout, continuing..."
 
       - name: Set up Platform - Run migrations
         run: |
@@ -251,7 +249,11 @@ jobs:
         run: |
           docker compose -f ../docker-compose.resolved.yml up -d --no-build
           echo "Waiting for rest_server to be ready..."
-          timeout 60 sh -c 'until curl -f http://localhost:8006/health 2>/dev/null; do sleep 2; done' || echo "Rest server health check timeout, continuing..."
+          timeout 180 sh -c 'until curl -f http://localhost:8006/health 2>/dev/null; do sleep 2; done' || {
+            echo "❌ rest_server did not become healthy in 180s"
+            docker compose -f ../docker-compose.resolved.yml logs --tail=100 rest_server
+            exit 1
+          }
         env:
           NEXT_PUBLIC_PW_TEST: true
 
@@ -266,20 +268,16 @@ jobs:
             exit 1
           }
 
-          # Dump auth.users + platform schema for cache (two separate dumps)
+          # Dump the platform schema for cache (includes the Better Auth
+          # user/session/account tables seeded by e2e_test_data.py)
           echo "Dumping database for cache..."
-          {
-            docker compose -f ../docker-compose.resolved.yml exec -T db \
-              pg_dump -U postgres --data-only --column-inserts \
-              --table='auth.users' postgres
-            docker compose -f ../docker-compose.resolved.yml exec -T db \
-              pg_dump -U postgres --data-only --column-inserts \
-              --schema=platform \
-              --exclude-table='platform._prisma_migrations' \
-              --exclude-table='platform.apscheduler_jobs' \
-              --exclude-table='platform.apscheduler_jobs_batched_notifications' \
-              postgres
-          } > /tmp/e2e_test_data.sql
+          docker compose -f ../docker-compose.resolved.yml exec -T db \
+            pg_dump -U postgres --data-only --column-inserts \
+            --schema=platform \
+            --exclude-table='platform._prisma_migrations' \
+            --exclude-table='platform.apscheduler_jobs' \
+            --exclude-table='platform.apscheduler_jobs_batched_notifications' \
+            postgres > /tmp/e2e_test_data.sql
 
           echo "✅ Database dump created for caching ($(wc -l < /tmp/e2e_test_data.sql) lines)"
 

@@ -0,0 +1,53 @@
+name: AutoGPT Platform - Supabase Auth Sweep
+
+# Re-runs the GoTrue -> Better Auth user copy as an idempotent sweep. The
+# bulk copy happens in Prisma migration
+# 20260716120000_copy_supabase_users_to_better_auth during the normal deploy;
+# run this once AFTER the frontend has switched to Better Auth to catch users
+# who signed up via GoTrue in between.
+
+on:
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: "Environment to sweep"
+        type: choice
+        required: true
+        options:
+          - develop
+          - production
+
+permissions:
+  contents: "read"
+
+jobs:
+  sweep:
+    environment: ${{ github.event.inputs.environment }}
+    name: Sweep GoTrue users into Better Auth
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+
+      - name: Set up pnpm
+        uses: pnpm/action-setup@v4
+        with:
+          package_json_file: autogpt_platform/frontend/package.json
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: "24.18.0"
+          cache: "pnpm"
+          cache-dependency-path: autogpt_platform/frontend/pnpm-lock.yaml
+
+      - name: Install dependencies
+        working-directory: ./autogpt_platform/frontend
+        run: pnpm install --frozen-lockfile
+
+      - name: Run sweep
+        working-directory: ./autogpt_platform/frontend
+        run: npx tsx scripts/migrate-supabase-auth.ts
+        env:
+          DATABASE_URL: ${{ secrets.BACKEND_DATABASE_URL }}
@@ -1,123 +1,15 @@
 ############
-# Secrets
-# YOU MUST CHANGE THESE BEFORE GOING INTO PRODUCTION
-############
-
-POSTGRES_PASSWORD=your-super-secret-and-long-postgres-password
-JWT_SECRET=your-super-secret-jwt-token-with-at-least-32-characters-long
-ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJhbm9uIiwKICAgICJpc3MiOiAic3VwYWJhc2UtZGVtbyIsCiAgICAiaWF0IjogMTY0MTc2OTIwMCwKICAgICJleHAiOiAxNzk5NTM1NjAwCn0.dc_X5iR_VP_qT0zsiyj_I_OZ2T9FtRU2BBNWN8Bu4GE
-SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyAgCiAgICAicm9sZSI6ICJzZXJ2aWNlX3JvbGUiLAogICAgImlzcyI6ICJzdXBhYmFzZS1kZW1vIiwKICAgICJpYXQiOiAxNjQxNzY5MjAwLAogICAgImV4cCI6IDE3OTk1MzU2MDAKfQ.DaYlNEoUrrEn2Ig7tqibS-PHK5vgusbcbo7X36XVt4Q
-DASHBOARD_USERNAME=supabase
-DASHBOARD_PASSWORD=this_password_is_insecure_and_should_be_updated
-SECRET_KEY_BASE=UpNVntn3cDxHJpq99YMc1T1AQgQpc8kfYTuRgBiYa15BLrx8etQoXz3gZv1/u2oq
-VAULT_ENC_KEY=your-encryption-key-32-chars-min
-
-
-############
-# Database - You can change these to any PostgreSQL database that has logical replication enabled.
+# Database
+# YOU MUST CHANGE THE PASSWORD BEFORE GOING INTO PRODUCTION
+#
+# These document the credentials hardcoded for the `db` service in
+# docker-compose.yml. If you change them there, also update DATABASE_URL /
+# DIRECT_URL in docker-compose.platform.yml, backend/.env(.default) and
+# frontend/.env(.default).
 ############
 
 POSTGRES_HOST=db
 POSTGRES_DB=postgres
 POSTGRES_PORT=5432
 # default user is postgres
-
-
-############
-# Supavisor -- Database pooler
-############
-POOLER_PROXY_PORT_TRANSACTION=6543
-POOLER_DEFAULT_POOL_SIZE=20
-POOLER_MAX_CLIENT_CONN=100
-POOLER_TENANT_ID=your-tenant-id
-
-
-############
-# API Proxy - Configuration for the Kong Reverse proxy.
-############
-
-KONG_HTTP_PORT=8000
-KONG_HTTPS_PORT=8443
-
-
-############
-# API - Configuration for PostgREST.
-############
-
-PGRST_DB_SCHEMAS=public,storage,graphql_public
-
-
-############
-# Auth - Configuration for the GoTrue authentication server.
-############
-
-## General
-SITE_URL=http://localhost:3000
-ADDITIONAL_REDIRECT_URLS=
-JWT_EXPIRY=3600
-DISABLE_SIGNUP=false
-API_EXTERNAL_URL=http://localhost:8000
-
-## Mailer Config
-MAILER_URLPATHS_CONFIRMATION="/auth/v1/verify"
-MAILER_URLPATHS_INVITE="/auth/v1/verify"
-MAILER_URLPATHS_RECOVERY="/auth/v1/verify"
-MAILER_URLPATHS_EMAIL_CHANGE="/auth/v1/verify"
-
-## Email auth
-ENABLE_EMAIL_SIGNUP=true
-ENABLE_EMAIL_AUTOCONFIRM=false
-SMTP_ADMIN_EMAIL=admin@example.com
-SMTP_HOST=supabase-mail
-SMTP_PORT=2500
-SMTP_USER=fake_mail_user
-SMTP_PASS=fake_mail_password
-SMTP_SENDER_NAME=fake_sender
-ENABLE_ANONYMOUS_USERS=false
-
-## Phone auth
-ENABLE_PHONE_SIGNUP=true
-ENABLE_PHONE_AUTOCONFIRM=true
-
-
-############
-# Studio - Configuration for the Dashboard
-############
-
-STUDIO_DEFAULT_ORGANIZATION=Default Organization
-STUDIO_DEFAULT_PROJECT=Default Project
-
-STUDIO_PORT=3000
-# replace if you intend to use Studio outside of localhost
-SUPABASE_PUBLIC_URL=http://localhost:8000
-
-# Enable webp support
-IMGPROXY_ENABLE_WEBP_DETECTION=true
-
-# Add your OpenAI API key to enable SQL Editor Assistant
-OPENAI_API_KEY=
-
-
-############
-# Functions - Configuration for Functions
-############
-# NOTE: VERIFY_JWT applies to all functions. Per-function VERIFY_JWT is not supported yet.
-FUNCTIONS_VERIFY_JWT=false
-
-
-############
-# Logs - Configuration for Logflare
-# Please refer to https://supabase.com/docs/reference/self-hosting-analytics/introduction
-############
-
-LOGFLARE_LOGGER_BACKEND_API_KEY=your-super-secret-and-long-logflare-key
-
-# Change vector.toml sinks to reflect this change
-LOGFLARE_API_KEY=your-super-secret-and-long-logflare-key
-
-# Docker socket location - this value will differ depending on your OS
-DOCKER_SOCKET_LOCATION=/var/run/docker.sock
-
-# Google Cloud Project details
-GOOGLE_PROJECT_ID=GOOGLE_PROJECT_ID
-GOOGLE_PROJECT_NUMBER=GOOGLE_PROJECT_NUMBER
+POSTGRES_PASSWORD=your-super-secret-and-long-postgres-password
@@ -2,5 +2,8 @@
 *.ign.*
 .application.logs
 
+# Local Postgres data (db service bind mount)
+volumes/db/data
+
 # Claude Code local settings only — the rest of .claude/ is shared (skills etc.)
 .claude/settings.local.json